CVE-2025-58594

Executive Summary

CVE-2025-58594 is a Missing Authorization vulnerability in the Brizy WordPress plugin, developed by themefusecom. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or actions. The vulnerability affects all versions of Brizy up to and including 2.7.12. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. No public proof-of-concept (PoC) or exploit code has been identified. The patch status is currently unknown, making this a high-priority issue for WordPress site administrators using the Brizy plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. Brizy is a popular page builder plugin distributed through the official WordPress plugin repository and third-party marketplaces. The missing authorization flaw could be exploited by any unauthenticated visitor to a WordPress site running a vulnerable version of Brizy. Since the patch status is unknown, site administrators must consider this a supply chain risk and either disable the plugin or implement strict access controls until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service is expected.

Threat Level: Medium. The low EPSS score suggests limited active exploitation, but the lack of a patch and the ease of exploitation (no authentication required) elevate the risk for WordPress sites using Brizy.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the Brizy plugin. In WordPress plugins, authorization checks are typically implemented using current_user_can() or similar functions to verify that the user has the required capabilities (e.g., edit_posts, manage_options). In this case, certain AJAX actions or REST API endpoints within Brizy fail to perform these checks, allowing unauthenticated users to trigger sensitive operations.

The exact vulnerable endpoint is not publicly documented, but based on the CWE and typical Brizy architecture, it likely involves:

• AJAX actions registered via wp_ajax_ and wp_ajax_nopriv_ hooks.
• REST API routes that handle page building, media uploads, or settings retrieval.

An attacker can send a crafted HTTP request to the vulnerable endpoint, bypassing the intended access control. This could lead to:

• Reading sensitive plugin configuration data.
• Accessing draft or private content.
• Triggering unintended plugin functionality.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding proper authorization checks. Below is an example of vulnerable vs. patched code for a typical WordPress AJAX handler.

Vulnerable Code (Brizy <= 2.7.12):

add_action('wp_ajax_brizy_export', 'brizy_export_handler');
add_action('wp_ajax_nopriv_brizy_export', 'brizy_export_handler');

function brizy_export_handler() {
    // Missing authorization check
    $data = $_POST['data'];
    // Process export...
    wp_send_json_success($result);
}

Patched Code (Hypothetical):

add_action('wp_ajax_brizy_export', 'brizy_export_handler');
// Remove the nopriv hook to prevent unauthenticated access

function brizy_export_handler() {
    // Add authorization check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $data = $_POST['data'];
    // Process export...
    wp_send_json_success($result);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site running Brizy <= 2.7.12.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common Brizy AJAX actions include brizy_export, brizy_import, brizy_save, etc.
2. Send a crafted POST request to the WordPress AJAX handler:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
        -d "action=brizy_export&data=test"
   

3. If the endpoint is vulnerable, the server will respond with data without requiring authentication.

Note: No public exploit code is available. The above is a generic example.

Blue Team (Defensive)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters starting with brizy_ from unauthenticated sources.
• Look for HTTP 200 responses to such requests without prior login.

Mitigation:

• Disable the Brizy plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to Brizy AJAX endpoints.
• Use a WordPress security plugin to enforce authentication on all AJAX actions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=brizy_* parameters from unauthenticated IPs.
  • Unusual HTTP response codes (200) for unauthenticated AJAX requests.
• File IOCs:
  • Presence of Brizy plugin files in /wp-content/plugins/brizy/ with version <= 2.7.12.
• Log IOCs:
  • WordPress debug log entries showing unauthorized access attempts to Brizy functions.

Detection Engineering

YARA Rule

rule CVE_2025_58594_Brizy_Missing_Auth {
    meta:
        description = "Detects Brizy plugin files vulnerable to CVE-2025-58594"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58594"
    strings:
        $vuln_func = "wp_ajax_nopriv_brizy" nocase
        $vuln_hook = "add_action('wp_ajax_nopriv_brizy" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-58594 - Brizy Missing Authorization
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to Brizy plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: action=brizy_
    condition: selection
falsepositives:
    - Legitimate authenticated users (if any)
level: medium

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-58594 - Brizy Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=brizy_"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Brizy plugin on all WordPress sites until a patch is released.
2. Implement a WAF rule to block unauthenticated requests to admin-ajax.php with action=brizy_* parameters.
3. Monitor logs for any signs of exploitation.

Long-term Actions:

1. Subscribe to Brizy's security advisories to receive patch notifications.
2. Apply the patch as soon as it is released by the vendor.
3. Conduct a security audit of all WordPress plugins to ensure proper authorization checks are in place.

Workaround:

• If disabling the plugin is not possible, use a WordPress security plugin (e.g., Wordfence) to enforce authentication on all AJAX actions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert