The Brizy WordPress plugin, prior to version 2.8.18, fails to verify that the requesting user has sufficient rights before outputting post data through a request handler named get_post_info. This flaw allows any user with Contributor or higher privileges to read the content of any post, regardless of its status—private, pending, or draft. An attacker who obtains contributor credentials can therefore access sensitive content belonging to other users, potentially revealing confidential data or proprietary material.

The vulnerability affects installations of the Brizy plugin for WordPress where the plugin version is older than 2.8.18. Any deployment running Brizy below this version is at risk. Administrators should check the plugin version on each site; if it is 2.8.18 or newer, the issue is resolved.

The CVSS score of 2.7 indicates a low severity information‑disclosure vulnerability that affects any WordPress site using Brizy below version 2.8.18. The EPSS score of less than 1% shows that exploitation is currently rare. The flaw allows any user with Contributor or higher privileges to read private, pending, or draft posts, exposing sensitive content. Because the plugin is widely used, an attacker who gains Contributor‑level access, whether through social engineering or compromise, can exploit the vulnerability. The issue remains off the CISA KEV catalog, but site owners should treat it like any other information‑disclosure issue.