Bricks Builder: Broken access control in query_result REST endpoint
Summary
Bricks Builder 2.4.3 and earlier, a WordPress plugin, contains a broken access control flaw in the POST /wp-json/bricks/v1/query_result REST endpoint. An unauthenticated attacker with a publicly obtainable nonce can manipulate the post_status and post_type parameters to read draft and private posts as well as WooCommerce coupon data (shop_coupon). The impact is limited to confidentiality; the CVSS vector indicates no integrity or availability impact.
Affected
- Bricks Builder 2.4.3 and earlier (reported as below 2.4.4)
- Related Bricks Theme component is fixed in the same release according to the vendor changelog (CVE-2026-118803 is listed as well)
Fixed in
- Bricks Builder 2.4.4
- The vendor changelog lists security fixes for CVE-2026-118804 and CVE-2026-118803. The exact code change has not been verified.
Workaround
- Unknown. No workaround has been published; patching is the only documented remedy.
Exploitation
- No known exploitation according to OffSeq; not listed in CISA KEV according to a GitHub tracker entry (CISA KEV not checked directly).
- No public proof of concept found; status unknown.
- EPSS: 0.25 %.
Our recommendation
- Update Bricks Builder and the Bricks Theme to 2.4.4 or later on all WordPress sites immediately, prioritising internet-facing sites.
- After the update, review draft and private posts for unintended exposure.
- For webshops, check whether WooCommerce coupon codes could have been exposed and rotate any sensitive coupons.
- Confirm the update was applied to both the plugin and the theme.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Bricks Builder 2.4.4 release notes bricksbuilder.io
- VulnCheck advisory www.vulncheck.com
- OffSeq radar CVE-2026-118804 radar.offseq.com
- Strix CVE-2026-118804 www.strix.ai
- ThreatInt CVE record cve.threatint.com
- VulDB CVE-2026-118804 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 11:35.
Original description (NVD)
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.