The Brizy – Page Builder plugin for WordPress suffers from missing authorization controls in the process_external_asset_urls function and lacks path validation in the store_file function in all versions up to 2.6.20. These flaws enable unauthenticated attackers to upload .TXT files to the server hosting the plugin. The vulnerability is tracked as CVE-2025-4370 with a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No official patch or remediation guidance is currently documented.

The vulnerability allows unauthenticated attackers to upload .TXT files to the server, which could lead to limited integrity impact. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild. The risk is limited by the file type restriction and lack of privilege escalation or broader access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for plugin updates from themefusecom and consider restricting file upload capabilities or disabling the plugin if not essential. No vendor advisory or patch links are currently available.