---
id: "CVE-2026-119325"
kind: "vulnerability"
aliases: ["CVE-2026-119325"]
title: "Bricks theme: unauthenticated visitors can read unpublished WordPress page content"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bricks-theme", "package", "self-hosted", "wordpress"]
not_affected_if: ["bricks-not-installed", "newer-version"]
published_at: "2026-10-29T21:17:21+00:00"
first_seen_at: "2026-10-29T21:26:52+00:00"
updated_at: "2026-10-29T21:28:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119325", "first_seen_at": "2026-10-29T21:26:52+00:00"}]
---

# Bricks theme: unauthenticated visitors can read unpublished WordPress page content

The Bricks WordPress theme (version 2.4 and earlier) exposes a REST endpoint, load_popup_content, that returns content without checking whether the page is published or whether the caller may see it. An anonymous attacker can read draft and unpublished page content by iterating the popupId parameter.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Bricks theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.
- Request `/wp-json/bricks/v1/load_popup_content` on the site and see whether it responds to anonymous requests.

## Fix

- Bricks theme: a version later than `2.4` (the sources do not name the fixed version).

## Timeline

- 2026-10-29T21:26:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119325

## From the sources

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_