CVE-2026-118804
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data.
Risk Assessment
An unauthenticated attacker can disclose unpublished and private content and WooCommerce coupon data, potentially leading to information leakage and business abuse.
Recommendation
Update Bricks Builder to a version later than 2.4.3 and consider restricting access to the query_result endpoint to trusted users.
Other vulnerabilities in Bricks Builder
See all- CVE-2026-40723Medium
Bricks Builder versions up to 2.1.4 contain a vulnerability in access control that may allow subscribers unauthorized access to resources.
- CVE-2026-41554High
Bricks Builder has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.9.2 to 2.2.
Original NVD description (English source)
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS