CVE-2026-119325 Bricks Theme Broken Access Control via load_popup_content
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119325?
CVE-2026-119325 is a high-severity vulnerability in Bricks Theme, published on 29 Oct 2026.
Official description
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.
Weakness: CWE-639
Which versions are affected by CVE-2026-119325?
How do I fix CVE-2026-119325?
No fix has been published for CVE-2026-119325 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119325 being exploited?
There is no known exploitation of CVE-2026-119325 in the wild and no public exploit code.
Sources
Also known as GHSA-g37c-4g9f-f29v.