CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including email addresses and hashed passwords of administrators.
Explanation of Vulnerability in Simple Terms
Brizy Page Builder versions up to 2.7.16 contain a privacy vulnerability that exposes sensitive user information to authenticated attackers. An attacker with low-level site access can read data they should not have permission to view. The vulnerability does not allow modification or deletion of data, only unauthorized disclosure.
What an attacker can do
Read sensitive user data and site information they should not have access to.
Potential impact on your site
User privacy data may be exposed to low-privilege site members; review access logs and audit user account permissions.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
