CVE-2026-16070 — Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parame…
Published: 2026-08-04 · CVSS: 2.7 · CVSS 3.1
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7