Filtered by vendor Brizy Subscriptions
Filtered by product Brizy Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-2897 1 Brizy 1 Brizy 2024-08-02 3.7 Low
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.