EUVD-2026-64639
GHSA-3pv4-5j2g-fvvj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint, low complexity; low-privilege authenticated session required; only popup confidentiality impacted, no integrity or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough - can read popup content they shouldn't have access to by passing a post ID in the URL.
AnalysisAI
Broken access control in Brave Popup Builder WordPress plugin (versions through 0.8.5) allows any authenticated low-privilege user - including Subscriber-level or WooCommerce Customer accounts - to read restricted popup content by supplying an arbitrary post ID in the URL. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR pattern where the server fails to validate whether the requesting user has rights to the resource identified by a user-supplied key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress authenticated session at Subscriber level or higher, or a WooCommerce Customer account - any account type that grants login access is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall real-world risk is moderate-to-low for most deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account (or uses an existing WooCommerce customer account) on a target WordPress site running Brave Popup Builder 0.8.5 or earlier. They then iterate or guess post IDs in a crafted URL targeting the plugin's popup-retrieval endpoint, successfully reading restricted popup content - such as draft promotions or gated offers - without any elevated authorization. … |
| Remediation | Update Brave Popup Builder to version 0.8.6 or later, which resolves the access control flaw; this is confirmed by the EUVD affected-version range (Brave 0 < 0.8.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today