CVE-2026-16070

Name of the Vulnerable Software and Affected Versions Brizy WordPress plugin versions prior to 2.8.19

Description An Insecure Direct Object Reference (IDOR) exists where the software fails to properly verify authorization on the object being modified before updating a template's type meta. The system validates a request parameter that differs from the one used in the write operation, enabling users with Contributor-level access and above to change the template-type assignment of templates owned by other users.

Recommendations Update the plugin to version 2.8.19 or later.