CVE-2026-40723
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Bricks Builder versions up to 2.1.4 contain a vulnerability in access control that may allow subscribers unauthorized access to resources.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data by subscribers, potentially leading to privacy and security breaches.
Recommendation
It is recommended to update Bricks Builder to a version above 2.1.4 to mitigate this access control vulnerability.
Other vulnerabilities in Bricks Builder
See all- CVE-2026-118804High
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data.
- CVE-2026-41554High
Bricks Builder has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.9.2 to 2.2.
Original NVD description (English source)
Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS