CVE-2020-36714

HIGH EXPLOITED

Brizy < 1.0.125 - Authenticated Authorization Bypass via is_administrator() Function

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-36714 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions.

References (2)

Core 2

Scores

CVSS v3 7.4
EPSS 0.0043
EPSS Percentile 33.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2020-06-03
CWE
CWE-285 CWE-863
Status published
Products (2)
brizy/brizy < 1.0.125
themefusecom/Brizy – Page Builder < 1.0.126
Published Oct 20, 2023
Tracked Since Feb 18, 2026