CVE-2025-4370: Brizy Page Builder Auth Bypass Vulnerability

CVE-2025-4370 Overview

CVE-2025-4370 affects the Brizy – Page Builder plugin for WordPress in all versions up to and including 2.6.20. The vulnerability stems from missing authorization on the process_external_asset_urls function combined with missing path validation in the store_file function. Unauthenticated attackers can upload .TXT files to affected servers without any credentials. The flaw is classified under CWE-862: Missing Authorization and carries a network-based attack vector with low attack complexity.

Critical Impact
Unauthenticated attackers can upload arbitrary .TXT files to the WordPress server, enabling content planting, SEO abuse, and potential staging for follow-on attacks.

Affected Products

Brizy – Page Builder plugin for WordPress, versions up to and including 2.6.20
Free WordPress distribution of Brizy (cpe:2.3:a:brizy:brizy:*:*:*:*:free:wordpress:*:*)
WordPress sites running vulnerable Brizy releases with anonymous access to plugin endpoints

Discovery Timeline

2025-07-29 - CVE-2025-4370 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4370

Vulnerability Analysis

The vulnerability originates in the Brizy plugin's media processing pipeline. The process_external_asset_urls function in editor/asset/media-processor.php accepts requests that trigger asset ingestion from external URLs. This endpoint does not enforce an authorization check, so any unauthenticated visitor can invoke it.

Once triggered, the plugin passes fetched content to the store_file function defined in editor/asset/static-file-trait.php. That function writes the fetched data to disk without validating the destination path or restricting the file extension beyond the .TXT type. Attackers can leverage this combination to place attacker-controlled text files under directories served by the WordPress site.

While the vulnerability does not permit direct upload of executable PHP files, uploaded .TXT content can be used for phishing pages, SEO poisoning, malware distribution staging, or robots.txt and .well-known file manipulation depending on where the file is written.

Root Cause

Two defects combine to produce the issue. First, process_external_asset_urls lacks a capability or nonce check, violating WordPress authorization guidance. Second, store_file accepts caller-supplied path components without normalizing or restricting them, so the resulting file location is not confined to a safe uploads directory.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends a crafted HTTP request to the vulnerable Brizy asset endpoint, referencing an external URL that returns text content. The plugin fetches the resource and writes the response to a server-side location. No authentication, user interaction, or elevated privileges are required.

A proof-of-concept exploit is not publicly listed in ExploitDB, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. Refer to the Wordfence Vulnerability Analysis and the WordPress Brizy Media Processor Code for further technical details.

Detection Methods for CVE-2025-4370

Indicators of Compromise

Unexpected .TXT files appearing under Brizy asset directories such as wp-content/uploads/brizy/
Outbound HTTP requests from the WordPress host to unfamiliar domains initiated by the PHP worker process
Access log entries hitting Brizy media processor endpoints from unauthenticated IPs
Newly created files whose contents match phishing kits, spam text, or attacker-controlled URLs

Detection Strategies

Inventory WordPress installations and flag any site running Brizy plugin version 2.6.20 or earlier
Review web server access logs for POST or GET requests targeting Brizy asset-processing routes without an authenticated session cookie
Compare file listings under wp-content/uploads/brizy/ against known-good baselines to spot planted text files
Alert on PHP processes issuing egress HTTP requests to unknown external hosts during page rendering

Monitoring Recommendations

Enable WordPress file integrity monitoring across the wp-content/uploads tree
Forward web server and PHP-FPM logs to a centralized SIEM for correlation with file-write events
Track plugin version drift using WordPress management tooling to catch outdated Brizy deployments
Monitor for repeated anonymous requests to plugin-specific endpoints that indicate probing

How to Mitigate CVE-2025-4370

Immediate Actions Required

Update the Brizy – Page Builder plugin to a version later than 2.6.20 as soon as a fixed release is available on the WordPress plugin repository
Audit the wp-content/uploads/brizy/ directory and remove any unrecognized .TXT files
Restrict anonymous access to Brizy asset endpoints at the web server or WAF layer until patching is complete
Rotate any credentials or API tokens that may have been referenced in planted files

Patch Information

The vulnerability affects Brizy versions through 2.6.20. Site administrators should install the latest available Brizy release from the WordPress plugin repository, which addresses both the missing authorization on process_external_asset_urls and the missing path validation in store_file. Review vendor changelogs to confirm inclusion of the fix before deployment.

Workarounds

Deactivate and remove the Brizy plugin if a patched version cannot be applied immediately
Deploy a Web Application Firewall rule that blocks unauthenticated requests to Brizy asset processor URIs
Enforce read-only permissions on the WordPress uploads directory where operationally feasible
Restrict outbound network egress from the WordPress host so the plugin cannot fetch attacker-supplied URLs

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~* /wp-content/plugins/brizy/.*/media-processor\.php$ {
    deny all;
    return 403;
}