CVE-2026-119325

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load popup content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks regenerate query nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load popup content endpoint to enumerate and disclose confidential content from any unpublished post on the site.