{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/bricks-theme--2.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:bricks:theme:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119325"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bricks Theme (\u003c= 2.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Bricks"],"content_html":"\u003cp\u003eBricks Theme for WordPress, in versions 2.4 and earlier, contains a broken access control vulnerability in the 'load_popup_content' REST API endpoint. The vulnerability allows anonymous users to access content that should be restricted, specifically draft and unpublished pages. There is no validation of user capabilities or post status checks when processing the 'popupId' parameter.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker interacts with the 'bricks_regenerate_query_nonce' action to obtain a valid public nonce.\u003c/li\u003e\n\u003cli\u003eAttacker makes an unauthenticated HTTP GET request to the '/wp-json/bricks/v1/load_popup_content' endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker specifies a 'popupId' parameter in the query string.\u003c/li\u003e\n\u003cli\u003eAttacker systematically iterates or increments the 'popupId' value to request unauthorized content.\u003c/li\u003e\n\u003cli\u003eThe application fails to perform authorization or status checks on the requested resource.\u003c/li\u003e\n\u003cli\u003eThe application returns the content of the draft or unpublished post to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized disclosure of draft, private, or unpublished website content, which may include sensitive information intended for internal review or future release.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Bricks Theme to a version later than 2.4 once a patch is released by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement access control monitoring on WordPress REST API endpoints to identify anomalous requests to 'load_popup_content'.\u003c/li\u003e\n\u003cli\u003eRestrict access to the WordPress REST API for unauthenticated users if it is not required for site functionality.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T23:07:57Z","date_published":"2026-10-29T23:07:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-bricks-theme-auth-bypass/","summary":"Bricks Theme versions 2.4 and earlier are vulnerable to an unauthenticated broken access control flaw allowing attackers to enumerate and disclose draft or unpublished post content via the load_popup_content REST endpoint.","title":"Bricks Theme: Unauthenticated data disclosure in REST API (CVE-2026-119325)","url":"https://feed.craftedsignal.io/briefs/2026-10-bricks-theme-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Bricks Theme (\u003c= 2.4)","version":"https://jsonfeed.org/version/1.1"}