Bricks Builder CVE-2026-118804

Requires a WordPress site running the Bricks Builder plugin/theme at version 2.4.3 or earlier with the /wp-json/bricks/v1/query_result REST endpoint reachable (standard in affected installs). The attacker must supply a nonce, which the description states is publicly obtainable, so this is not a practical limiting factor; no user authentication, no privileges, and no user interaction are required. Exploitation is performed by submitting crafted post_status (draft/private) or post_type (shop_coupon) values in the originalQueryVars parameter. The primary limiting factor is simply having a vulnerable Bricks version installed and internet-reachable; there is no indication a non-default configuration is needed.

This is a credible, near-term priority rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) reflects what the description confirms: a remote, low-complexity request to a REST endpoint with no authentication, using a nonce the description explicitly calls 'publicly obtainable,' so the nonce is not a meaningful barrier. Impact is confidentiality-only (C:H/I:N/A:N) - disclosure of unpublished, private, and WooCommerce coupon data - which matches CWE-862 (Missing Authorization). The vuln.today decision label is 'this_week,' and the finding is attributed to VulnCheck with a dedicated advisory, lending analyst credibility. Key signals are MISSING: no EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so exploitation probability cannot be quantified. There is no conflict between the CVSS vector and the description - both agree on remote unauthenticated access. Net: a real, easily-triggered data-disclosure bug in a popular WordPress builder, worth prioritizing on the vendor's 'this_week' timeline, but with no evidence of active or automated exploitation at the time of analysis.

An unauthenticated attacker obtains the publicly available nonce from a Bricks-powered WordPress site, then sends a crafted POST to /wp-json/bricks/v1/query_result with originalQueryVars setting post_status to draft/private or post_type to shop_coupon. The endpoint returns content the standard WordPress REST API would block, exposing unpublished posts, private pages, and WooCommerce coupon codes. No public exploit code is identified in the provided data, though the attack is simple enough to reproduce from the advisory description.