CVE-2025-4370 - CVE House

Back to Database

Status published Medium CVE-2025-4370

Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload

5.3 CVSS

Vulnerability Description

The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as well as missing path validation in store_file function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated attackers to upload .TXT files on the affected site's server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-4370

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Michael Mazzolini

References

More from themefusecom

View All →

WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability

WordPress Brizy plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function

Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgery

WordPress ThemeFuse Maintenance Mode plugin <= 1.1.3 - CSRF to Stored XSS vulnerability

Affected Vendor

themefusecom

View all reports →

Affected Software

Brizy – Page Builder

Vulnerable Versions:

0

Timeline

Official Publish: July 29th, 2025

Last Modified: April 8th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal