Skip to main content

WPScan still flags Brizy Pro 2.8.12 (outdated "no known fix" entries)

Michael Calas

Hi Brizy team,

This note is more of a comment than a question.

My host, IONOS, runs a daily vulnerability scan using the WPScan database, and it flags Brizy Pro on my site (gigiandgabybooks.com) even though I'm on the latest version, Brizy Pro 2.8.12 with Brizy 2.8.24.

The warning comes from two WPScan entries for Brizy Pro, both published April 2025, that are still listed as having no known fix:
- Cross-Site Request Forgery (affects 2.6.1 and earlier)
- Missing Authorization (affects 2.6.1 and earlier)

Patchstack lists these same issues as fixed in Brizy Pro 2.8.1, so it looks like WPScan's records were never updated. Because there's no fixed version on file, hosts that use WPScan flag every version of Brizy Pro, including the current one.

Could you report the fixed version to WPScan so they can update those entries? That should clear the warning for every Brizy Pro user on hosts like IONOS.

WPScan page: https://wpscan.com/plugin/brizy-pro/
Patchstack entry: https://patchstack.com/database/wordpress/plugin/brizy-pro/vulnerability/wordpress-brizy-pro-plugin-2-6-1-broken-access-control-vulnerability

Thanks!
Michael

0

Comments

1 comment

Date Votes
  • KC George

    Hello Michael,

    Thank you for bringing the WPScan vulnerability report to our attention. We appreciate you helping us ensure that the reported security information accurately reflects the current patch status.

    WPScan’s report references two existing sources:

    1. CVE-2025-26902: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26902
    2. Wordfence vulnerability report: https://www.wordfence.com/threat-intel/vulnerabilities/id/9705d293-ea89-46dc-95f5-15ff0f9c8d1e

    Since WPScan did not originally research this vulnerability, the appropriate next step is to request that its team review the existing references and update the vulnerability record accordingly, rather than submit a separate patch to WPScan.

    The CVE reference, in turn, points to the Patchstack report. Both Patchstack and Wordfence have updated their respective databases to reflect the patched status. WPScan should therefore review these references and update its own database to reflect the available evidence.

    We’ll contact WPScan directly to request the update. It would also be helpful if you could send them a similar email to reinforce the request. Here’s a suggested message you can use:

    Subject: Request to Update WPScan Vulnerability Record – Brizy PRO CVE-2025-26902

    Hello WPScan Team,

    I’m contacting you on behalf of the Brizy team to request a review and update of the following vulnerability record in the WPScan Vulnerability Database:

    The record currently displays “No known fix.” However, this vulnerability has been addressed in a subsequent release of Brizy PRO, and the corresponding Wordfence vulnerability record identifies version 2.8.1 as the fixed version, with versions up to and including 2.8.0 affected.

    You can review the supporting information here:

    We understand that WPScan relies on authoritative references when maintaining its vulnerability database. Since the supporting vulnerability records have been updated to reflect the fix, could you please review this evidence and update the WPScan entry to reflect the confirmed patched status and the appropriate fixed version?

    Keeping this information consistent across vulnerability databases is important to ensure that users receive accurate security information and can make informed decisions about updating their websites.

    Thank you for your time and assistance. We appreciate your help in keeping the WPScan Vulnerability Database accurate and up to date.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

Ask a Question