What is the CVSS score of EUVD-2026-52595?

EUVD-2026-52595 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-52595?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52595. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-52595?

Yes, a patch is available for EUVD-2026-52595. Update the affected software to the latest version immediately.

Brizy WordPress Plugin EUVD-2026-52595

| CVE-2026-16070 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-04 WPScan

GHSA-w3xr-4xq6-f7jx

WordPress Authentication Bypass Brizy Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Contributor-level WordPress access maps to PR:L, not PR:H; impact is integrity-only on template metadata with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 15:32 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.

AnalysisAI

Authorization bypass in the Brizy WordPress plugin before 2.8.19 permits authenticated Contributor-level users to hijack template-type metadata on templates owned by other users. The plugin validates authorization against one request parameter while executing the write operation against a different, attacker-controlled parameter - a textbook CWE-639 Insecure Direct Object Reference variant. A publicly available exploit is documented by WPScan; however, no active exploitation is confirmed via CISA KEV, and the EPSS score of 0.13% (3rd percentile) indicates negligible observed in-the-wild activity.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes exactly what occurs here: the authorization gate and the mutation target are decoupled, allowing an attacker to pass validation using a legitimate object reference while directing the write to an arbitrary object. In the Brizy page builder's template management endpoint, the plugin checks permissions on one parameter but performs the template-type meta update on a separately supplied parameter, meaning the authorized object and the modified object are never verified to be the same. The affected product is identified by CPE cpe:2.3:a:unknown:brizy:*:*:*:*:*:*:*:* covering all Brizy releases from 0 up to, but not including, 2.8.19. The flaw is confined to the WordPress plugin layer and does not implicate the WordPress core or PHP runtime.

RemediationAI

Update the Brizy WordPress plugin to version 2.8.19 or later, which contains the vendor-released patch addressing this authorization bypass. The fix is documented in the WPScan advisory at https://wpscan.com/vulnerability/aa57d5b9-ba51-476c-9e64-fd431b89fa8a/. If immediate patching is not feasible, site administrators can remove or demote any untrusted Contributor accounts as a compensating control, accepting the trade-off of limiting content-creation capacity. Alternatively, administrators can audit the wp_postmeta table for unexpected template-type assignments on high-value templates to detect any unauthorized changes made prior to patching. No server-level network blocking is effective since the attack requires authenticated HTTP requests through normal plugin endpoints.