The Brizy Pro plugin up to version 2.6.1 contains a missing authorization flaw that allows users without the appropriate privileges to execute actions that should be restricted. This could enable an attacker to add, edit or delete content, break page layouts or inject malicious content, thereby compromising the integrity of the site. The vulnerability grants control over the plugin’s functions without proper authentication checks.

Any WordPress installation that utilizes the Brizy Pro plugin with version 2.6.1 or earlier is affected. The flaw exists in all builds released from the initial deployment through 2.6.1, meaning that all sites running those versions are potentially vulnerable.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the WordPress administrative interface, where a user that can authenticate with any account may exploit the lack of proper access control to elevate privileges for Brizy content management. Attack requires an existing WordPress user account but does not require additional privileges beyond what is normally granted to that role.