CVE-2026-119325

HighCVSS 7.5

Published: 29/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

Bricks Theme 2.4 and earlier for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint. An anonymous attacker can read draft and unpublished page content by supplying a popupId parameter without any status or capability checks.

Risk Assessment

An attacker can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment popupId to enumerate and disclose confidential content from unpublished posts. This poses an information disclosure risk.

Recommendation

Update Bricks Theme to a version later than 2.4. Until patched, consider restricting access to the load_popup_content endpoint.

Other vulnerabilities in Bricks Theme

CVE-2026-118803High
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash.

Original NVD description (English source)

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS