Bricks Broken Access Control via query_result Endpoint

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• vulncheck.com/…roken-access-control-via-query-result-endpoint Üçüncü taraf
• bricksbuilder.io/release/bricks-2-4-4 Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:18Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-75520Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
• 7,3 CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpoints
• 6,5 CVE-2026-118757PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
• 5,3 CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
• 6,5 CVE-2026-105620PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
• 5,7 CVE-2026-105618PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent