Broken Access Control Vulnerability in Bricks Builder by Bricks
CVE-2026-118804

7.5HIGH

Key Information:

Vendor

WordPress
Status
Bricks Builder
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118804?

Bricks Builder versions up to 2.4.3 are vulnerable to a broken access control issue that permits unauthenticated attackers to access private and unpublished post content. By manipulating the originalQueryVars parameter during a POST request to the /wp-json/bricks/v1/query_result REST endpoint, attackers can exploit crafted post_status and post_type values, gaining access to restricted posts and sensitive WooCommerce coupon data that should otherwise be protected by standard WordPress REST API security measures.

Affected Version(s)

Bricks Builder 0 < 2.4.4

References

https://bricksbuilder.io/release/bricks-2-4-4/
release-notes
https://www.vulncheck.com/advisories/bricks-broken-access...
third-party-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Omer Musaddaq
.