Live › vulnerability › CVE-2026-119325
The Bricks WordPress theme (version 2.4 and earlier) exposes a REST endpoint, load_popup_content, that returns content without checking whether the page is published or whether the caller may see it. An anonymous attacker can read draft and unpublished page content by iterating the popupId parameter.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Sites running the Bricks theme at version 2.4 or earlier on WordPress are exposed through the public REST endpoint. Any unpublished or draft page on such a site can be read without logging in. Sites not using Bricks, or running a newer version, are not affected by this report.
No product ranges from the sources yet.
/wp-json/bricks/v1/load_popup_content on the site and see whether it responds to anonymous requests.2.4 (the sources do not name the fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-119325")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.