The Brizy WordPress plugin versions prior to 2.8.18 contain an authorization bypass vulnerability (CWE-639) where insufficient authorization checks on a request handler permit users with Contributor or higher roles to read arbitrary post content. This includes posts that are private, pending, or drafts owned by other users. The vulnerability arises from improper verification of user permissions before returning post content, potentially exposing sensitive unpublished or restricted information.

Users with Contributor or higher roles can read the content of arbitrary posts, including private, pending, and draft posts of other users. This could lead to unauthorized disclosure of sensitive or unpublished content within the WordPress site. There is no indication of remote code execution or privilege escalation beyond content disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.8.18, upgrading to version 2.8.18 or later (once confirmed) is recommended. Until an official fix is available, restrict Contributor role permissions or limit access to trusted users only.