PEACH
Un cadre d’isolation des locataires
Base de données de vulnérabilitésCVE-2026-77116
CVE-2026-77116:
WordPress Analyse et atténuation des vulnérabilités
Aperçu
CVE-2026-77116 is a broken access control (IDOR) vulnerability in the Brave Popup Builder WordPress plugin (slug: brave-popup-builder) that allows any authenticated user — including those with Subscriber or WooCommerce Customer roles — to read restricted popup content by manipulating a post ID in the URL. It affects all versions through 0.8.5, with version 0.8.6 introducing the fix. The vulnerability was publicly disclosed on August 21, 2026, and assigned by WPScan. WPScan classifies it with a CVSS score of 4.3 (Medium), while Feedly estimates it as HIGH severity (WPScan, GitHub Advisory).
Détails techniques
The root cause is a missing authorization check in the bravepop_render_popup() function located in lib/render.php, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). This function is hooked to wp_head at priority 9 and, when the brave_popup query parameter is present, only verifies is_user_logged_in() — performing no capability check, ownership check, or post_status validation. An attacker can enumerate WordPress post IDs via ?brave_popup={id} to retrieve draft, pending, private, or scheduled popup content, as well as bypass all targeting rules (geo, UTM, referrer, audience filters) since the preview branch forces all match conditions to true. This is a distinct and separate vulnerability from CVE-2025-68508, which was an unauthenticated AJAX-based bypass fixed in version 0.8.4; the GET-based preview path in lib/render.php was never patched in that release (WPScan).
Impact
Successful exploitation allows any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) to read popup content that should be restricted, including draft campaigns, unreleased promotional content, coupon codes not yet intended for public use, hidden form fields, and potentially integration endpoints or newsletter list IDs embedded in popup configuration data. Because the preview branch bypasses all audience targeting rules, even published popups restricted by geo-location, UTM parameters, referrer, or other conditions can be exposed. While this vulnerability does not enable code execution or privilege escalation, it poses a meaningful confidentiality risk for businesses using the plugin to manage sensitive marketing campaigns or gated content (WPScan).
Exploitabilité
There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time; WPScan has indicated the PoC will be published on September 4, 2026, to allow time for users to update. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid WordPress login (Subscriber-level or above), making the attack surface relatively broad on sites with open registration or WooCommerce storefronts (WPScan, GitHub Advisory).
Étapes d’exploitation
- Obtain low-privilege access: Register or log in to the target WordPress site as a Subscriber or WooCommerce Customer — no elevated permissions are required.
- Identify the target site: Confirm the site uses the Brave Popup Builder plugin (version ≤ 0.8.5) by checking plugin indicators in page source or HTTP headers.
- Enumerate post IDs: Craft GET requests to the site's front end appending
?brave_popup={id}with incrementing integer values (e.g.,https://example.com/?brave_popup=42), iterating through the WordPress post ID sequence. - Extract popup content: For each ID that returns rendered popup HTML in the page
<head>, parse the response to extractpopup_datametadata, which may include draft campaign content, coupon codes, form configurations, or integration endpoints. - Bypass targeting rules: Because the preview branch forces all targeting conditions (
userTypeMatch,refererMatch,countryMatch, etc.) totrue, any popup — regardless of its audience restrictions — will render for the authenticated attacker (WPScan).
Indicateurs de compromis
- Network: Repeated GET requests to the site's front-end URLs containing the
?brave_popup=query parameter with sequentially or randomly varying integer values from a single authenticated session. - Logs: WordPress access logs showing a pattern of requests like
GET /?brave_popup=<id>from the same authenticated user across many different post IDs in a short time window. - Application Behavior: Unusual rendering of popup HTML in page
<head>responses for non-popup pages, particularly for draft or restricted-status posts, visible in server-side debug or audit logs if enabled.
Atténuation et solutions de contournement
The vendor has released Brave Popup Builder version 0.8.6, which addresses this vulnerability. Site administrators should update the plugin immediately via the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository. As a temporary workaround prior to patching, administrators can restrict site registration to prevent untrusted users from obtaining Subscriber-level accounts, or disable the plugin until the update can be applied. Proper remediation requires adding capability and post_status checks to the bravepop_render_popup() function in lib/render.php (WPScan, GitHub Advisory).
Réactions de la communauté
The vulnerability was discovered and reported by independent researcher Huseyin Mertoglu, who published a detailed write-up at their personal site. WPScan verified and published the advisory, noting the distinction from the previously patched CVE-2025-68508. The CVE was noted on Bluesky via automated CVE tracking accounts shortly after disclosure. No significant broader media coverage or vendor statements beyond the WPScan advisory have been observed (WPScan).
Ressources additionnelles
Source: Ce rapport a été généré à l’aide de l’IA
Apparenté WordPress Vulnérabilités:
Évaluation gratuite des vulnérabilités
Évaluez votre posture de sécurité dans le cloud
Évaluez vos pratiques de sécurité cloud dans 9 domaines de sécurité pour évaluer votre niveau de risque et identifier les failles dans vos défenses.
Obtenez une démo personnalisée
Prêt(e) à voir Wiz en action ?
"La meilleure expérience utilisateur que j’ai jamais vue, offre une visibilité totale sur les workloads cloud."
David EstlickRSSI
"Wiz fournit une interface unique pour voir ce qui se passe dans nos environnements cloud."
Adam FletcherChef du service de sécurité
"Nous savons que si Wiz identifie quelque chose comme critique, c’est qu’il l’est réellement."
Greg PoniatowskiResponsable de la gestion des menaces et des vulnérabilités