Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress is vulnerable to authorization bypass due to type juggling in all versions up to, and including, 3.3.0. This is due to the use of loose comparison (==) instead of strict comparison (===) when validating the installation ID in the `/wp-json/mailin/v1/mailin_disconnect` REST API endpoint. This makes it possible for unauthenticated attackers to disconnect the Brevo integration, delete the API key, remove all subscription forms, and reset plugin settings by sending a boolean `true` value for the `id` parameter, which bypasses the authorization check through PHP type juggling.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-14799 Authorization Bypass in Brevo WordPress Plugin via Type Juggling Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-14799
Post summary
The text discloses a type‑juggling based authorization bypass in the Brevo WordPress plugin, but no PoC, patch, or active exploitation details are provided.
CVE-2025-14799 The Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress is vulnerable to authorization bypass due to type juggling in all versions up to, and including… https://www.cve.org/CVERecord?id=CVE-2025-14799
Post summary
The Brevo WordPress plugin is vulnerable to an authorization bypass caused by type juggling across all versions up to and including the latest, as documented in CVE‑2025‑14799.