CVE-2026-118804

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post status and post type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query result REST endpoint using a publicly obtainable nonce. Attackers can set post status to draft or private, or post type to shop coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.