VulnSocial

CVE-2026-119325

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-30: 110-30
Referenced assets1 URL
Full discourse1 post
  • CSIRT TELCONET@CSIRT_Telconet

    Bricks Theme (WordPress) expone borradores y páginas no publicadas sin autenticación (CVE-2026-119325). Actualiza a la última versión. Más información: https://csirt.telconet.net/comunicacion/boletines-servicios/vulnerabilidad-de-control-de-acceso-en-bricks-theme-para-wordpress-permite-leer-contenido-no-publicado-sin-autenticacion/ https://t.co/RSans2vJb3

    1000055
    875 followersView on X

Explore more

Back to dashboard