CVE-2026-119325: Bricks Theme Broken Access Control via load_popup_content
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricksregeneratequerynonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/loadpopupcontent endpoint to enumerate and disclose confidential content from any unpublished post on the site.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker needs no account or prior privileges. They can obtain a public nonce through the bricks_regenerate_query_nonce action, submit requests to the /wp-json/bricks/v1/load_popup_content endpoint, and vary the popupId parameter to enumerate content.
What information could be exposed?
The issue can disclose draft and other unpublished page or post content. The available data describes an impact to confidentiality only; it does not indicate modification or deletion of content.
Are sites using an affected version exposed by default?
The vulnerable endpoint lacks status and capability checks, and exploitation uses a publicly obtainable nonce without authentication. Based on the available information, affected sites with unpublished content reachable through this endpoint are exposed without requiring an attacker to log in.
What can be done while a patch cannot be applied?
The provided data does not identify a supported workaround. Prioritize restricting access to the affected REST endpoint or otherwise preventing unauthenticated requests to it until an update can be deployed.