The Brizy – Page Builder plugin for WordPress suffers from a missing capability check in its 'update_item' function in all versions up to and including 2.4.44. This authorization bypass allows authenticated users with contributor-level access or higher to modify the content of any published post, potentially injecting malicious JavaScript. The vulnerability is classified under CWE-862 (Missing Authorization). It has a CVSS 3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The impact includes integrity compromise of post content and limited availability impact.

Authenticated users with contributor or higher privileges can modify arbitrary published posts, including injecting malicious JavaScript, which can lead to content integrity compromise and potential cross-site scripting (XSS) attacks. This could facilitate further attacks on site visitors or administrators. The vulnerability does not affect confidentiality directly and has a low impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious content changes. Avoid granting contributor or higher privileges to untrusted users. Review and harden WordPress user role permissions as a temporary mitigation.