Bricks Theme 2.4 and earlier for WordPress exposes the load_popup_content REST endpoint without authentication or status checks. An anonymous attacker can request a public nonce and then iterate the popupId parameter to read draft and unpublished page content. The vulnerability affects any public WordPress site running a vulnerable version of the theme, and no user interaction is needed.
Bricks · Bricks Theme
Bricks Builder 2.4.3 and earlier, a WordPress plugin, contains a broken access control flaw in the POST /wp-json/bricks/v1/query_result REST endpoint. An unauthenticated attacker with a publicly obtainable nonce can manipulate the post_status and post_type parameters to read draft and private posts as well as WooCommerce coupon data (shop_coupon). The impact is limited to confidentiality; the CVSS vector indicates no integrity or availability impact.
Bricks · Bricks Builder
Bricks Theme 2.4.3 and earlier contains an unauthenticated dynamic data tag injection vulnerability in the query_result REST endpoint. Anonymous attackers can control the urlParams value, which is then parsed as a Bricks dynamic data tag. An attacker can use tags such as author_meta:user_pass to leak post meta and the post author's user record, including the password hash, without logging in.
Bricks · Bricks Theme
