CVE-2026-14195 Overview
CVE-2026-14195 is a broken access control vulnerability in the Brizy WordPress plugin versions prior to 2.8.18. The plugin fails to properly verify authorization in a request handler before returning post content. Authenticated users with the Contributor role or higher can read arbitrary post content, including private, pending, and draft posts belonging to other users. The flaw is categorized as an Insecure Direct Object Reference [CWE-639].
Critical Impact
Authenticated low-privilege users can access confidential post content authored by other users, including unpublished drafts and pending editorial material.
Affected Products
- Brizy WordPress plugin versions prior to 2.8.18
- WordPress sites permitting Contributor-level or higher registration
- Multi-author WordPress deployments using Brizy for page building
Discovery Timeline
- 2026-08-01 - CVE-2026-14195 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-14195
Vulnerability Analysis
The Brizy plugin exposes a request handler that returns post content without confirming the requester has permission to view the referenced post. WordPress enforces visibility rules for private, pending, and draft posts through capability checks such as read_private_posts and post-author ownership. The vulnerable handler bypasses these checks and returns content based solely on the supplied post identifier.
A Contributor-level account is the minimum privilege required. Contributors can create their own posts but should not read other users' unpublished material. By manipulating the post identifier submitted to the handler, an authenticated attacker retrieves content they are not entitled to view.
The issue is limited to confidentiality. The advisory does not describe write access, code execution, or availability impact from this specific handler.
Root Cause
The root cause is missing authorization enforcement in a plugin request handler. The handler performs authentication verification but does not evaluate whether the authenticated user has the WordPress capability to read the specific post being requested. This pattern maps directly to [CWE-639: Authorization Bypass Through User-Controlled Key].
Attack Vector
Exploitation requires an authenticated session with the Contributor role or higher. The attacker sends a crafted request to the vulnerable Brizy endpoint referencing a target post ID. The plugin returns the post content regardless of the post's status or ownership. No user interaction from the victim is required.
The vulnerability manifests in the Brizy request handler responsible for serving post content to the editor. See the WPScan Vulnerability Report for advisory details.
Detection Methods for CVE-2026-14195
Indicators of Compromise
- Requests to Brizy plugin endpoints from Contributor-level accounts referencing post IDs the user did not author
- Unusual volume of Brizy AJAX or REST requests from a single authenticated session iterating sequential post IDs
- Access log entries showing Contributor accounts retrieving content associated with draft or pending posts
Detection Strategies
- Correlate WordPress user role assignments with plugin endpoint access patterns to identify unauthorized reads
- Inspect web server access logs for repeated calls to Brizy request handlers containing varying post_id parameters
- Monitor for enumeration behavior against Brizy endpoints originating from low-privileged authenticated sessions
Monitoring Recommendations
- Enable WordPress audit logging for content access events and role-based activity
- Forward WordPress and web server logs to a centralized platform for correlation and retention
- Alert on Contributor or Author accounts issuing high rates of requests to plugin endpoints outside normal editorial workflows
How to Mitigate CVE-2026-14195
Immediate Actions Required
- Update the Brizy WordPress plugin to version 2.8.18 or later on all affected sites
- Audit existing Contributor, Author, and Editor accounts and remove unnecessary or dormant users
- Review draft, pending, and private posts for evidence of unauthorized access since the plugin was installed
Patch Information
Upgrade to Brizy version 2.8.18 or later. The maintainers addressed the missing authorization check in the affected request handler. Refer to the WPScan Vulnerability Report for advisory tracking.
Workarounds
- Restrict new user registration and require administrator approval for Contributor-or-higher role assignments until patched
- Temporarily deactivate the Brizy plugin on multi-author sites where an immediate update is not feasible
- Apply web application firewall rules that constrain access to Brizy request handlers based on authenticated user identity
# Update Brizy via WP-CLI
wp plugin update brizy --version=2.8.18
wp plugin list --name=brizy --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
