CVE-2025-4370 Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload

What is CVE-2025-4370?

CVE-2025-4370 is a medium-severity missing authorization vulnerability in themefusecom Brizy – Page Builder, published on 29 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as well as missing path validation in store_file function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated attackers to upload .TXT files on the affected site's server.

Weakness: CWE-862

Which versions are affected by CVE-2025-4370?

It affects 1 product.

Products include Brizy Brizy.

How do I fix CVE-2025-4370?

No fix has been published for CVE-2025-4370 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-4370 being exploited?

There is no known exploitation of CVE-2025-4370 in the wild and no public exploit code.

Other vulnerabilities in themefusecom Brizy – Page Builder

• CVE-2024-10960 Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads Critical 9.9
• CVE-2024-3242 Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload High 8.8
• CVE-2024-1311 Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload High 8.8
• CVE-2024-3667 Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL High 7.4
• CVE-2020-36714 Brizy < 1.0.126 - Authorization Bypass to Settings Updates High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p6h5-x466-mj5p.