{"uuid": "f5d49e94-7822-46a6-bd8c-a81895c1f101", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38344", "type": "seen", "source": "https://t.me/hacking_Attack/27603", "content": "Black Hat Ethical Hacking\nBrizy WordPress Plugin Exploit Chains Allow Full Site Takeovers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Brizy WordPress Plugin Exploit Chains Allow Full Site TakeoversPost Views: 78 \nReading Time: 2 Minutes\nVulnerabilities in the Brizy Page Builder plugin for WordPress sites could be chained together to allow attackers to completely take over a website, according to researchers.\nBrizy (or Brizy \u2013 Page Builder) has been installed on more than 90,000 sites. It\u2019s billed as an intuitive website builder for those without technical skills. It comes with a collection of more than 500 pre-designed blocks, maps and video integration and drag-and-drop design functionality. According to researchers, it also came with a stored cross-site scripting (XSS) issue and an arbitrary file-upload vulnerability prior to version 2.3.17.\n\nThese two bugs, when combined with another flaw that allows authorization bypass and privilege escalation, can become dangerous, Wordfence researchers cautioned.\n\n\u201cDuring a routine review of our firewall rules, we found traffic indicating that a vulnerability might be present in the Brizy \u2013 Page Builder plugin, though it did not appear to be under active attack,\u201d researchers at Wordfence explained in a Wednesday posting. \u201cThis led us to discover two new vulnerabilities as well as a previously patched access-control vulnerability in the plugin that had been reintroduced.\u201d\n\nThe two fresh bugs can both be chained with the re-introduced access control vulnerability to allow complete site takeover, researchers explained. In a combo with the stored XSS bug, any logged-in user would be able to modify any published post and inject malicious JavaScript to it. A pairing with the other bug could meanwhile allow any logged-in user to upload potentially executable files and achieve remote code execution.\nSee Also: Complete Offensive Security and Ethical Hacking Course Foundation for Attack: A Re-Introduced Access Control BugThe older access-control bug (now tracked as CVE-2021-38345) was patched in June 2020, but reintroduced in version 1.0.127 this year. It\u2019s a high-severity issue that stems from a lack of proper authorization checks, according to Wordfence, allowing attackers to modify posts.\n\nResearchers noted that the plugin uses a pair of administrator functions for a wide variety of authorization checks, and \u201cany user that passed one of these checks was assumed to be an administrator.\u201d They added, \u201cbeing logged in and accessing any endpoint in the wp-admin directory was sufficient to pass this check.\u201d\n\nThe upshot of this is that all logged-in users, such as subscribers to a newsletter, were allowed to modify any post or page that had been created or edited with the Brizy editor, even if it had already been published.\n\n\u201cWhile this vulnerability might only be a nuisance on its own, allowing attackers to replace the original contents of pages, it enabled two additional vulnerabilities that could each be used to take over a site,\u201d according to Wordfence\u2019s analysis.\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Authenticated Stored Cross-Site ScriptingThe first follow-on bug is a medium-severity stored XSS issue (CVE-2021-38344), which allows attackers to inject malicious scripts into web pages. Because it\u2019s a stored XSS bug, rather than a reflected one, victims need only visit the infected page in order to be attacked.\n\nOn its own, the bug allows a lower-privileged user (such as a contributor or subscriber) to add JavaScript to an update request, which would then be executed if the post were viewed or previewed by another u[...]", "creation_timestamp": "2026-09-01T20:02:13.729748Z"}