CVE-2026-14195

Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.

Affected

Brizy

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 21st percentile

Published

2026-08-01

Updated

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2ed270b0-c01e-4615-b365-3455c161a2d9/

References

• CVE Record
• NVD entry