Bricks Theme for WordPress exposes draft pages to unauthenticated users (EUVD-2026-113376)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Bricks
- Product
- Bricks Theme
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-113376 describes an unauthenticated broken access control flaw in Bricks Theme 2.4 and earlier, scored 7.5/10 (CVSS v3.1). According to the entry, anonymous attackers can read draft and unpublished page content through the load_popup_content REST endpoint by supplying a popupId parameter.
If you use Bricks
Update Bricks Theme to a version later than 2.4 once a fixed release is confirmed.
Review draft and unpublished pages for content that should not be visible publicly.
Check web server logs for requests to the load_popup_content REST endpoint.
Update the Bricks Theme to a version later than 2.4 once a fixed release is confirmed
Check whether draft or unpublished pages contain sensitive content
Restrict or monitor access to the load_popup_content REST endpoint until patched
What the sources say 2
· Mastodon: “Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId paramete” Source
· Mastodon: “Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId par...” Source