Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers

A stored XSS and arbitrary file-upload can be paired with an authorization bypass to wreak havoc.

in the Brizy Page Builder plugin for WordPress sites could be chained together to allow attackers to completely take over a website, according to researchers.

Brizy (or Brizy – Page Builder) has been installed on more than 90,000 sites. It’s billed as an intuitive website builder for those without technical skills. It comes with a collection of more than 500 pre-designed blocks, maps and video integration and drag-and-drop design functionality. According to researchers, it also came with a stored cross-site scripting (XSS) issue and an arbitrary file-upload prior to version 2.3.17.

These two bugs, when combined with another flaw that allows authorization bypass and privilege escalation, can become dangerous, researchers cautioned.

“During a routine review of our firewall rules, we found traffic indicating that a vulnerability might be present in the Brizy – Page Builder plugin, though it did not appear to be under active ,” researchers at Wordfence explained in a Wednesday posting. “This led to discover two new vulnerabilities as well as a previously patched access-control vulnerability in the plugin that

Read More: https://threatpost.com/brizy-wordpress-plugin-exploit-site-takeovers/175463/