CVE-2020-36714
📋 TL;DR
The Brizy WordPress plugin up to version 1.0.125 contains an authorization bypass vulnerability due to an incorrect capability check in the is_administrator() function. This allows authenticated attackers (any logged-in user) to access administrative AJAX functions they shouldn't have permission to use. WordPress sites using vulnerable Brizy plugin versions are affected.
💻 Affected Systems
- WordPress Brizy Page Builder Plugin
📦 What is this software?
Brizy by Brizy
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify site content, inject malicious code, steal sensitive data, or take full control of the WordPress site through administrative functions.
Likely Case
Authenticated users escalate privileges to perform administrative actions like modifying pages, posts, or plugin settings without proper authorization.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized administrative actions that can be detected and rolled back.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. Public proof-of-concept code exists demonstrating the bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.126 and later
Vendor Advisory: https://wordpress.org/plugins/brizy/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Brizy Page Builder. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.0.126+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Brizy Plugin
allTemporarily disable the Brizy plugin until patched
wp plugin deactivate brizy
Restrict User Registration
allDisable new user registration to limit potential attackers
Settings → General → Membership: Uncheck 'Anyone can register'
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual administrative actions by non-admin users
- Use web application firewall (WAF) rules to block suspicious AJAX requests to Brizy endpoints
🔍 How to Verify
Check if Vulnerable:
Check Brizy plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin list --name=brizy --field=versionVerify Fix Applied:
Verify Brizy plugin version is 1.0.126 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to /wp-admin/admin-ajax.php with 'action' parameter containing 'brizy' from non-admin users
- Administrative actions performed by low-privilege users
Network Indicators:
- POST requests to WordPress AJAX endpoints with Brizy-specific actions from unauthorized IPs/users
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "brizy" AND (user_role!="administrator" OR user_id NOT IN admin_users)🔗 References
- https://blog.nintechnet.com/wordpress-brizy-page-builder-plugin-fixed-critical-vulnerabilities/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9495e25d-a5a6-4f25-9363-783626e58a4a?source=cve
- https://blog.nintechnet.com/wordpress-brizy-page-builder-plugin-fixed-critical-vulnerabilities/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9495e25d-a5a6-4f25-9363-783626e58a4a?source=cve
