This issue is a missing authorization flaw in the themefusecom Brizy WordPress plugin. The bug creates a broken access control that allows users with inappropriate privileges—or potentially unauthenticated users—to perform actions that should be restricted. The vulnerability could enable tampering with site configuration, content, or other privileged settings, leading to unauthorized data modification or compromise of site integrity.

The Brizy plugin for WordPress, produced by themefusecom, is affected from the earliest available version through any revision up to and including 2.7.12. No other products are listed as impacted.

The CVSS score of 4.3 indicates a moderate risk rating, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Since the defect involves missing authorization checks, the likely attack vector is an authenticated session with insufficient privileges. An attacker with any user access, or possibly an unauthenticated actor if the plugin exposes endpoints, could exploit the flaw to gain unauthorized control over the plugin’s restricted functions.