CVE-2026-118804: Bricks Broken Access Control via query_result Endpoint
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint using a publicly obtainable nonce. Attackers can set poststatus to draft or private, or posttype to shopcoupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Bricks Builder version 2.4.3 or earlier are affected. The vulnerable REST endpoint can expose unpublished posts, private content, and WooCommerce coupon data that standard WordPress REST API routes would normally block.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. Exploitation requires a publicly obtainable nonce and crafted post_status and post_type values supplied through the originalQueryVars parameter in a POST request to /wp-json/bricks/v1/query_result.
What content could be disclosed?
An attacker can request draft or private post statuses to retrieve unpublished or private post content. They can also use the shop_coupon post type to disclose WooCommerce coupon data.