What is the CVSS score of CVE-2026-14195?

CVE-2026-14195 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14195?

Yes, a public proof-of-concept exploit is available for CVE-2026-14195. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14195?

Yes, a patch is available for CVE-2026-14195. Update the affected software to the latest version immediately.

Brizy WordPress Plugin CVE-2026-14195

EUVD-2026-51704 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-01 WPScan

GHSA-8cq8-g7rh-54g9

WordPress Authentication Bypass Brizy Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Contributor is a low-privilege WordPress role, making PR:L more accurate than the NVD-assigned PR:H; impact is read-only confidentiality.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:45 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

2.7 (None) 2.7 (LOW)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 01, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.

AnalysisAI

Improper authorization in the Brizy WordPress plugin before 2.8.18 allows any authenticated user holding the Contributor role or above to read the full content of arbitrary posts, bypassing WordPress's native visibility controls for private, pending, and draft posts. The flaw resides in a specific request handler that returns post content without verifying whether the requesting user is entitled to view it (CWE-639, IDOR). A publicly available proof-of-concept exploit has been published by WPScan; however, no confirmed active exploitation appears in CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects limited observed exploitation activity at time of analysis.

Technical ContextAI

Brizy is a drag-and-drop page builder plugin for WordPress. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a class of Insecure Direct Object Reference (IDOR) flaw where a server-side request handler returns content based on a caller-supplied identifier - in this case a post ID or similar key - without confirming the caller holds read permission for that object. WordPress natively restricts visibility of posts in 'private', 'draft', and 'pending' status to their authors and privileged roles (Editor/Administrator). The Brizy plugin's request handler bypasses this model by responding with content to any authenticated request, regardless of the requester's relationship to the post. The affected CPE is cpe:2.3:a:unknown:brizy:*:*:*:*:*:*:*:* covering all versions before 2.8.18.

RemediationAI

Vendor-released patch: Brizy version 2.8.18. Site administrators should update the Brizy plugin to 2.8.18 or later immediately via the WordPress dashboard or wp-cli. The WPScan advisory at https://wpscan.com/vulnerability/2ed270b0-c01e-4615-b365-3455c161a2d9/ confirms this fix version. If an immediate upgrade is not feasible, a compensating control is to temporarily revoke or limit Contributor-role accounts on the site, particularly for untrusted external contributors, noting this disrupts publishing workflows. Restricting access to the vulnerable request handler endpoint via WAF rules targeting the specific Brizy AJAX action (if identifiable from the POC) is a second compensating option, though the handler's exact endpoint name is not specified in available data.