Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2021-38345 Details

Description

The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/ CVEVendor Advisory
https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/ [email protected]Vendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-863Incorrect Authorization[email protected]
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')[email protected]

Affected Products

ProductVersions
brizy brizy-page builder
< 1.0.1.126
>= 1.0.127, <= 2.3.11

CPE

  • cpe:2.3:a:brizy:brizy-page_builder:*:*:*:*:wordpress:*:*:*
  • cpe:2.3:a:brizy:brizy-page_builder:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2021-38345
NVD Published Date:
Oct 14, 2021
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2021-38345 Details - Not Deferred