Description

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-23T06:17:27.833Z",
  "pubdate": "2026-08-23T06:17:27.833Z",
  "executiveSummary": "A broken access control vulnerability exists in the Brave Popup Builder plugin, identified by the slug brave-popup-builder, affecting all versions through 0.8.5. This security flaw permits unauthorized information disclosure by allowing low-privileged authenticated users, specifically those with Subscriber or WooCommerce Customer roles, to access and read confidential popup content that should be restricted.\nThe vulnerability poses a moderate risk to confidentiality, as attackers can bypass intended authorization boundaries and harvest sensitive text, media, or configuration data embedded within restricted popups. Exploitation requires minimal attacker capabilities, specifically a standard low-privileged user account on the target WordPress installation, and involves interacting directly with the application via manipulated uniform resource locators.\nNo complex attack chains or specialized privileges beyond basic authentication are necessary to trigger the flaw, making it easily reproducible. Remediation requires updating the affected software to a patched version once available or applying strict authorization checks within the vulnerable endpoint handling routines.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient or absent authorization checks within the access control logic of the Brave Popup Builder plugin. Specifically, the component responsible for rendering or retrieving popup content fails to properly validate whether the requesting user possesses the necessary administrative or editing capabilities associated with the requested resource.\nThe vulnerability affects versions through 0.8.5 of the brave-popup-builder plugin. The attack surface is exposed over the network via standard HTTP or HTTPS protocols, accessible to any authenticated user regardless of their assigned role limitations, such as a basic Subscriber or a standard WooCommerce Customer.\nThe exploitation method relies on insecure direct object references or predictable parameter handling. An attacker initiates the attack flow by authenticating to the target WordPress site with low-privilege credentials. Once authenticated, the attacker crafts a malicious HTTP request by passing an arbitrary or targeted post ID directly in the URL parameters corresponding to the popup retrieval functionality.\nUpon receiving the request, the vulnerable component processes the supplied post ID without performing adequate capability checks or verifying ownership and access permissions. Consequently, the application bypasses security checks and returns the sensitive popup content in the HTTP response body.\nThe post-exploitation impact is strictly confined to unauthorized information disclosure. By systematically iterating through various post IDs, an attacker can harvest proprietary data, marketing strategies, coupon codes, or sensitive communications intended only for specific user segments or site administrators, thereby compromising the overall confidentiality posture of the target web application."
}