The vulnerability resides in the Brizy – Page Builder plugin’s use of the get_users() function, which allows an attacker with Contributor‑level access or higher to retrieve email addresses and hashed passwords of administrators. This flaw is a classic example of CWE‑359: Exposure of Sensitive Information. The primary consequence is the compromise of confidential data, specifically user credentials that can be leveraged for further attacks such as credential stuffing or phishing.

WordPress sites running the Brizy – Page Builder plugin version 2.7.16 or older are impacted. The plugin is distributed by themefuse.com. No specific sub‑versions beyond 2.7.16 have been confirmed as secure; all earlier versions inherit the flaw.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score of less than 1% suggests this issue is not widely exploited in the wild as of now. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access at the Contributor level or higher, making the exploit experience more limited to legitimate users of the site. However, once authenticated, the attacker can read sensitive user data, potentially escalating privileges or compromising other accounts.