CVE-2025-4370: Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on processexternalasseturls function as well as missing path validation in storefile function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated attackers to upload .TXT files on the affected site's server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4370?
CVE-2025-4370 has been classified as a medium severity vulnerability due to limited file uploads and potential exploitation.
How do I fix CVE-2025-4370?
To fix CVE-2025-4370, update the Brizy Page Builder plugin to version 2.6.21 or later.
What versions of Brizy Page Builder are affected by CVE-2025-4370?
All versions of Brizy Page Builder up to and including 2.6.20 are affected by CVE-2025-4370.
What kind of attacks can CVE-2025-4370 enable?
CVE-2025-4370 can allow attackers to upload unauthorized files due to missing authorization and path validation.
Is CVE-2025-4370 resolved in future releases of Brizy?
Yes, CVE-2025-4370 is resolved in versions of Brizy Page Builder released after 2.6.20.