---
id: "CVE-2026-118804"
kind: "vulnerability"
aliases: ["CVE-2026-118804"]
title: "Bricks Builder: unauthenticated REST call exposes drafts, private posts and coupons"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bricks-builder", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["default-config"]
published_at: "2026-10-28T22:17:14+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:36:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118804", "first_seen_at": "2026-10-28T22:35:34+00:00"}]
---

# Bricks Builder: unauthenticated REST call exposes drafts, private posts and coupons

Bricks Builder 2.4.3 and earlier lets an unauthenticated visitor POST crafted post_status and post_type values to its query_result REST endpoint, using a publicly obtainable nonce. An attacker can read draft and private posts and WooCommerce shop_coupon data that standard WordPress REST routes would block.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Bricks version in the theme's style.css or the WordPress admin under Appearance > Themes; versions `2.4.3` and earlier are affected.
- Test whether `/wp-json/bricks/v1/query_result` is reachable on the site.

## Fix

- Update Bricks Builder to a version newer than `2.4.3`; the fixed version is unknown from the sources.
- Until patched, restrict or block access to `/wp-json/bricks/v1/query_result` at the web server or WAF.

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118804

## From the sources

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_