Bricks Theme CVE-2026-119325

No special configuration is required - the load_popup_content REST endpoint is exposed by default in Bricks Theme 2.4 and earlier and performs no status or capability check, so exploitation works against default installations. Prerequisites an attacker must satisfy: obtain a public nonce via the bricks_regenerate_query_nonce action (publicly available, not a credential) and iterate the popupId parameter. What LIMITS impact: the vulnerability discloses only draft/unpublished post content, so a site with no unpublished or sensitive draft posts has little to lose; it grants no write access, no authentication, and no code execution. The only confirmed remediation path in the evidence is updating to Bricks 2.4.1.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity flaw needing no privileges and no user interaction, with impact confined to confidentiality - no integrity or availability loss. The description supports every metric: an anonymous attacker reaches the REST endpoint over the network and enumerates content with a simple incrementing parameter. No EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified here. The CVE is not listed in CISA KEV in the provided data, and no exploit/PoC is marked as confirmed, so there is no evidence of active exploitation. The SSVC/decision signal supplied is vuln.today priority 'this_week' (not act_now or emergency), which aligns with a serious-but-not-fire-drill information-disclosure issue rather than a wormable RCE. Net: this is a genuine priority for sites running Bricks Theme that hold sensitive unpublished content, but its impact ceiling is read-only disclosure of draft posts, not code execution or data modification - a real high-CVSS issue whose practical blast radius is bounded by confidentiality only. Key missing data: EPSS and KEV status were not provided and should be checked before final prioritization.

An anonymous attacker requests a public nonce from the bricks_regenerate_query_nonce action, then sends repeated requests to /wp-json/bricks/v1/load_popup_content with incrementing popupId values. Because the endpoint performs no status or capability check, the server returns the body of draft and unpublished posts, letting the attacker harvest embargoed announcements, unreleased pricing, or other confidential pre-publication content. No authentication, user interaction, or special timing is required; the attack is straightforward and scriptable.