Bricks Builder
Monthly
Broken access control in the Bricks Builder WordPress plugin/theme through version 2.4.3 lets unauthenticated remote attackers read content that WordPress would otherwise withhold, including draft and private posts and WooCommerce coupon records, through the plugin's /wp-json/bricks/v1/query_result REST endpoint. An attacker submits crafted post_status and post_type values inside the originalQueryVars parameter; the required nonce is described as publicly obtainable, so it does not act as a real barrier, and no authentication or user interaction is needed. Scored 7.5 with confidentiality-only impact (CWE-862) and flagged as a this-week priority; no public exploit identified at time of analysis.
Reflected cross-site scripting in Bricks Builder WordPress theme through version 1.9.2 to 2.2 enables remote attackers to execute malicious JavaScript in victim browsers by crafting URLs with unsanitized input that gets reflected into generated web pages without proper encoding. Exploitation requires victim interaction (clicking a malicious link) but no authentication, making phishing and social engineering viable delivery methods. EPSS and KEV data not available; no public exploit confirmed at time of analysis, though Patchstack disclosure suggests security researchers have demonstrated the vulnerability.
Broken Access Control in Bricks Builder for WordPress (versions up to and including 2.1.4) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privilege roles such as editor or administrator. Rooted in CWE-862 (Missing Authorization), the flaw means certain builder endpoints or AJAX actions execute without verifying whether the requesting user holds sufficient capabilities. No public exploit code identified at time of analysis, and this CVE is not listed in CISA KEV; however, the low authentication barrier (any registered subscriber) on sites with open registration increases realistic exposure.
Broken access control in the Bricks Builder WordPress plugin/theme through version 2.4.3 lets unauthenticated remote attackers read content that WordPress would otherwise withhold, including draft and private posts and WooCommerce coupon records, through the plugin's /wp-json/bricks/v1/query_result REST endpoint. An attacker submits crafted post_status and post_type values inside the originalQueryVars parameter; the required nonce is described as publicly obtainable, so it does not act as a real barrier, and no authentication or user interaction is needed. Scored 7.5 with confidentiality-only impact (CWE-862) and flagged as a this-week priority; no public exploit identified at time of analysis.
Reflected cross-site scripting in Bricks Builder WordPress theme through version 1.9.2 to 2.2 enables remote attackers to execute malicious JavaScript in victim browsers by crafting URLs with unsanitized input that gets reflected into generated web pages without proper encoding. Exploitation requires victim interaction (clicking a malicious link) but no authentication, making phishing and social engineering viable delivery methods. EPSS and KEV data not available; no public exploit confirmed at time of analysis, though Patchstack disclosure suggests security researchers have demonstrated the vulnerability.
Broken Access Control in Bricks Builder for WordPress (versions up to and including 2.1.4) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privilege roles such as editor or administrator. Rooted in CWE-862 (Missing Authorization), the flaw means certain builder endpoints or AJAX actions execute without verifying whether the requesting user holds sufficient capabilities. No public exploit code identified at time of analysis, and this CVE is not listed in CISA KEV; however, the low authentication barrier (any registered subscriber) on sites with open registration increases realistic exposure.