CVE-2025-0969

Published: Dec 13, 2025Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@wordfence.com (Secondary)

Description

The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including email addresses and hashed passwords of administrators.

Related CWEs

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

References (4)

https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/api.php#L961

Source: security@wordfence.com

https://plugins.trac.wordpress.org/changeset/3392844

Source: security@wordfence.com

https://wordpress.org/plugins/brizy/#developers

Source: security@wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/5987ef13-15d6-4ecf-894c-f22c8726402b?source=cve

Source: security@wordfence.com

Timeline

No history available yet.