Bricks Theme Plugin up to 2.4.0 Popup Content load_popup_content popupId access control

Summaryinfo

A vulnerability categorized as problematic has been discovered in Bricks Theme Plugin up to 2.4.0. This vulnerability affects unknown code of the file /wp-json/bricks/v1/load_popup_content of the component Popup Content. The manipulation of the argument popupId results in access control. This vulnerability is reported as CVE-2026-119325. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Bricks Theme Plugin up to 2.4.0. Affected is an unknown functionality of the file /wp-json/bricks/v1/load_popup_content of the component Popup Content. The manipulation of the argument popupId with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality. CVE summarizes:

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

The advisory is shared for download at bricksbuilder.io. This vulnerability is traded as CVE-2026-119325 since 10/29/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-113376). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Bricks

Name

• Theme Plugin

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion