CVE-2023-2897 - CVE House

Back to Database

Status published Low CVE-2023-2897

Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass

3.7 CVSS

Vulnerability Description

The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2897

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Alex Thomas

References

More from themefusecom

View All →

WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability

Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload

WordPress Brizy plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function

Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgery

Affected Vendor

themefusecom

View all reports →

Affected Software

Brizy – Page Builder

Vulnerable Versions:

0

Timeline

Official Publish: June 9th, 2023

Last Modified: April 8th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.