CVE-2026-16070: Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brizy - Page Builderto a version that resolves this vulnerability.Fixed in 2.8.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16070?
CVE-2026-16070 has a risk rating of 36, indicating a significant vulnerability.
How do I fix CVE-2026-16070?
To fix CVE-2026-16070, update the Brizy Page Builder plugin to version 2.8.19 or later.
What systems are affected by CVE-2026-16070?
CVE-2026-16070 affects all versions of the Brizy Page Builder plugin prior to 2.8.19.
Who is impacted by CVE-2026-16070?
Users with Contributor-level access and above can exploit CVE-2026-16070 due to improper authorization checks.
What kind of vulnerability is CVE-2026-16070?
CVE-2026-16070 is an Insecure Direct Object Reference (IDOR) vulnerability that allows unauthorized template type modification.