Bricks Theme: Unauthenticated data disclosure in REST API (CVE-2026-119325)

Bricks Theme for WordPress, in versions 2.4 and earlier, contains a broken access control vulnerability in the 'load_popup_content' REST API endpoint. The vulnerability allows anonymous users to access content that should be restricted, specifically draft and unpublished pages. There is no validation of user capabilities or post status checks when processing the 'popupId' parameter.

Attack Chain

1. Attacker interacts with the 'bricks_regenerate_query_nonce' action to obtain a valid public nonce.
2. Attacker makes an unauthenticated HTTP GET request to the '/wp-json/bricks/v1/load_popup_content' endpoint.
3. Attacker specifies a 'popupId' parameter in the query string.
4. Attacker systematically iterates or increments the 'popupId' value to request unauthorized content.
5. The application fails to perform authorization or status checks on the requested resource.
6. The application returns the content of the draft or unpublished post to the attacker.

Impact

Unauthorized disclosure of draft, private, or unpublished website content, which may include sensitive information intended for internal review or future release.

Recommendation

• Update Bricks Theme to a version later than 2.4 once a patch is released by the vendor.
• Implement access control monitoring on WordPress REST API endpoints to identify anomalous requests to 'load_popup_content'.
• Restrict access to the WordPress REST API for unauthenticated users if it is not required for site functionality.