Cpe:2.3:a:bricks:theme:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3abrickstheme/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 23:07:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBricks Theme: Unauthenticated data disclosure in REST API (CVE-2026-119325)https://feed.craftedsignal.io/briefs/2026-10-bricks-theme-auth-bypass/Thu, 29 Oct 2026 23:07:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-bricks-theme-auth-bypass/Bricks Theme versions 2.4 and earlier are vulnerable to an unauthenticated broken access control flaw allowing attackers to enumerate and disclose draft or unpublished post content via the load_popup_content REST endpoint.Bricks Theme for WordPress, in versions 2.4 and earlier, contains a broken access control vulnerability in the 'load_popup_content' REST API endpoint. The vulnerability allows anonymous users to access content that should be restricted, specifically draft and unpublished pages. There is no validation of user capabilities or post status checks when processing the 'popupId' parameter.

Attack Chain

  1. Attacker interacts with the 'bricks_regenerate_query_nonce' action to obtain a valid public nonce.
  2. Attacker makes an unauthenticated HTTP GET request to the '/wp-json/bricks/v1/load_popup_content' endpoint.
  3. Attacker specifies a 'popupId' parameter in the query string.
  4. Attacker systematically iterates or increments the 'popupId' value to request unauthorized content.
  5. The application fails to perform authorization or status checks on the requested resource.
  6. The application returns the content of the draft or unpublished post to the attacker.

Impact

Unauthorized disclosure of draft, private, or unpublished website content, which may include sensitive information intended for internal review or future release.

Recommendation

  • Update Bricks Theme to a version later than 2.4 once a patch is released by the vendor.
  • Implement access control monitoring on WordPress REST API endpoints to identify anomalous requests to 'load_popup_content'.
  • Restrict access to the WordPress REST API for unauthenticated users if it is not required for site functionality.
]]>highadvisory