Brizy Page Builder WordPress Plugin Limited File Upload Vulnerability

A vulnerability allowing limited file uploads has been identified in the Brizy Page Builder plugin for WordPress, affecting all versions through 2.6.20. The issue arises from missing authorization in the 'process_external_asset_urls' function and inadequate path validation in the 'store_file' function. This flaw enables unauthenticated attackers to upload .TXT files to the server of the affected site.

Impact

Exploitation of this vulnerability allows for unauthorized file uploads, which could be leveraged for various malicious purposes, such as executing scripts or causing a denial-of-service.

Remediation

Users are advised to update the Brizy Page Builder plugin to version 2.6.21 or a newer patched version.