CVE-2026-14195

2.7 lowEPSS 0.3%

Low (2.7). EPSS 0.3% chance of exploitation in the next 30 days.

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.

Severity

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-08-01
Modified: 2026-08-26
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/2ed270b0-c01e-4615-b365-3455c161a2d9/

Check your stack JSON