Input validation vulnerability in Brizy – Page Builder 2.4.18

The Brizy Page Builder plugin for WordPress is vulnerable to a security issue called “IP Address Spoofing” in versions 2.4.18 and earlier. This problem happens because the plugin trusts user-supplied IP addresses in an ‘X-Forwarded-For’ HTTP header. This header is used to validate if someone is allowed to access the website and if it is on the “whitelist.” If someone supplies a whitelisted IP address in the ‘X-Forwarded-For’ header, it will allow anyone to bypass the website’s maintenance mode and possibly access private information or restricted functionalities.