The Brizy – Page Builder plugin for WordPress suffers from a CWE-22 path traversal vulnerability affecting all versions up to 2.4.39. Authenticated attackers with contributor or higher privileges can manipulate the 'id' parameter to bypass directory restrictions and upload files to arbitrary server locations. This improper limitation of pathname to a restricted directory can lead to unauthorized file placement, potentially impacting the integrity of the server environment. The vulnerability does not affect confidentiality or availability directly but impacts integrity. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows authenticated users with contributor-level or higher access to upload files outside the intended directories, potentially enabling unauthorized modification of server files. This can lead to integrity issues on the affected system. There is no indication of impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access where possible and monitor for suspicious file uploads related to the plugin. Avoid granting contributor or higher privileges to untrusted users. Follow vendor communications for updates on patches or official mitigations.