CVE-2026-16070 Overview
CVE-2026-16070 is a broken access control vulnerability in the Brizy WordPress plugin before version 2.8.19. The plugin fails to properly verify authorization on the object being modified when updating a template's type meta. It validates a request parameter that differs from the one used in the write operation. This flaw allows authenticated users with Contributor-level access or higher to change the template-type assignment of templates owned by other users. The vulnerability is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key), also known as Insecure Direct Object Reference (IDOR).
Critical Impact
Authenticated contributors can tamper with template metadata belonging to other users, leading to integrity loss on site templates.
Affected Products
- Brizy WordPress plugin versions prior to 2.8.19
- WordPress installations with Contributor-level or higher user accounts
- Sites relying on Brizy templates for content publishing workflows
Discovery Timeline
- 2026-08-04 - CVE-2026-16070 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-16070
Vulnerability Analysis
The Brizy plugin exposes an endpoint that updates a template's type meta field. During authorization, the plugin checks permissions against one request parameter but performs the write operation against a different parameter. This parameter mismatch decouples the authorization check from the actual object being modified. An attacker with Contributor-level access can supply a valid identifier they own for the authorization check while targeting a different template owned by another user in the write parameter. The result is an authorization bypass on the intended target object, categorized as [CWE-639].
Root Cause
The root cause is inconsistent object identification between authorization and write logic. The plugin authorizes the request based on a parameter the attacker can freely control, then writes to a separate object identifier without re-validating ownership. This design pattern breaks the invariant that permission checks must apply to the exact object being modified.
Attack Vector
Exploitation requires authentication at Contributor level or higher, which limits the pool of potential attackers to registered users. The attacker crafts an HTTP request to the vulnerable template-update endpoint, supplying a template ID they legitimately own in the parameter checked by the authorization logic and a victim template ID in the parameter used for the actual meta update. The request travels over the network to the WordPress site. Impact is limited to integrity of template-type metadata; confidentiality and availability are not affected. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-16070
Indicators of Compromise
- Unexpected changes to template type meta fields on templates not owned by the acting user
- WordPress audit log entries showing Contributor accounts modifying templates authored by Editors or Administrators
- HTTP POST requests to Brizy template update endpoints referencing multiple template identifiers within the same request body
Detection Strategies
- Review WordPress database postmeta entries associated with Brizy templates for anomalous type value changes
- Correlate web server access logs with WordPress user session data to identify Contributor-level users invoking template management endpoints
- Deploy web application firewall rules that flag requests where authorization identifiers and target identifiers diverge
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record template metadata modifications with user attribution
- Alert on any template modification performed by users below Editor role
- Monitor the Brizy plugin version across managed WordPress deployments to identify installations still below 2.8.19
How to Mitigate CVE-2026-16070
Immediate Actions Required
- Upgrade the Brizy WordPress plugin to version 2.8.19 or later on all affected sites
- Audit existing templates for unauthorized type meta changes and restore correct values where required
- Review Contributor-level accounts and remove any that are inactive or unnecessary
Patch Information
The vendor fixed the issue in Brizy version 2.8.19 by aligning the authorization check with the object identifier used in the write operation. Site administrators should update through the WordPress plugin management interface or via WP-CLI. Confirm the installed version matches or exceeds 2.8.19 after patching.
Workarounds
- Temporarily restrict Contributor-level account creation until the plugin is updated
- Disable the Brizy plugin on sites where an immediate upgrade is not feasible
- Apply web application firewall rules that block requests to Brizy template management endpoints from lower-privileged sessions
# Configuration example
wp plugin update brizy --version=2.8.19
wp plugin get brizy --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
