What is CVE-2026-14195?

CVE-2026-14195 is a low-severity vulnerability in Brizy, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 2.7/10. Published 2026-08-01.

How severe is CVE-2026-14195?

Low severity. CVSS v3 base score is 2.7 out of 10.

Auth bypass in Brizy

CVE-2026-14195

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (7.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.

Affected products

Unknown Brizy — versions 0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-14195?: CVE-2026-14195 is a low-severity vulnerability in Brizy, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 2.7/10. Published 2026-08-01.
How severe is CVE-2026-14195?: Low severity. CVSS v3 base score is 2.7 out of 10.