CVE-2024-6254: 
WordPress vulnerability analysis and mitigation

The Brizy – Page Builder plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.5.1. The vulnerability was discovered and reported by Wordfence, and was assigned CVE-2024-6254 (MITRE CVE).

The vulnerability stems from missing or incorrect nonce validation on form submissions. This security flaw has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating that it requires user interaction but can be exploited remotely without authentication (NVD).

When exploited, this vulnerability allows unauthenticated attackers to submit forms intended for public use as another user through forged requests. On WordPress installations where unfiltered_html is enabled, this can lead to stored Cross-Site Scripting (XSS) payloads being unknowingly added by administrators (MITRE CVE).

Users should update their Brizy – Page Builder plugin to a version newer than 2.5.1 to address this vulnerability. The fix involves proper implementation of nonce validation for form submissions (WordPress Changeset).