PEACH
Uma estrutura de isolamento de inquilino
Banco de Dados de VulnerabilidadesCVE-2026-77116
CVE-2026-77116:
WordPress Análise e mitigação de vulnerabilidades
Visão geral
CVE-2026-77116 is a broken access control (IDOR) vulnerability in the Brave Popup Builder WordPress plugin (slug: brave-popup-builder) that allows any authenticated user — including those with Subscriber or WooCommerce Customer roles — to read restricted popup content by manipulating a post ID in the URL. It affects all versions through 0.8.5, with version 0.8.6 introducing the fix. The vulnerability was publicly disclosed on August 21, 2026, and assigned by WPScan. WPScan classifies it with a CVSS score of 4.3 (Medium), while Feedly estimates it as HIGH severity (WPScan, GitHub Advisory).
Detalhes técnicos
The root cause is a missing authorization check in the bravepop_render_popup() function located in lib/render.php, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). This function is hooked to wp_head at priority 9 and, when the brave_popup query parameter is present, only verifies is_user_logged_in() — performing no capability check, ownership check, or post_status validation. An attacker can enumerate WordPress post IDs via ?brave_popup={id} to retrieve draft, pending, private, or scheduled popup content, as well as bypass all targeting rules (geo, UTM, referrer, audience filters) since the preview branch forces all match conditions to true. This is a distinct and separate vulnerability from CVE-2025-68508, which was an unauthenticated AJAX-based bypass fixed in version 0.8.4; the GET-based preview path in lib/render.php was never patched in that release (WPScan).
Impacto
Successful exploitation allows any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) to read popup content that should be restricted, including draft campaigns, unreleased promotional content, coupon codes not yet intended for public use, hidden form fields, and potentially integration endpoints or newsletter list IDs embedded in popup configuration data. Because the preview branch bypasses all audience targeting rules, even published popups restricted by geo-location, UTM parameters, referrer, or other conditions can be exposed. While this vulnerability does not enable code execution or privilege escalation, it poses a meaningful confidentiality risk for businesses using the plugin to manage sensitive marketing campaigns or gated content (WPScan).
Exploração
There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time; WPScan has indicated the PoC will be published on September 4, 2026, to allow time for users to update. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid WordPress login (Subscriber-level or above), making the attack surface relatively broad on sites with open registration or WooCommerce storefronts (WPScan, GitHub Advisory).
Etapas de exploração
- Obtain low-privilege access: Register or log in to the target WordPress site as a Subscriber or WooCommerce Customer — no elevated permissions are required.
- Identify the target site: Confirm the site uses the Brave Popup Builder plugin (version ≤ 0.8.5) by checking plugin indicators in page source or HTTP headers.
- Enumerate post IDs: Craft GET requests to the site's front end appending
?brave_popup={id}with incrementing integer values (e.g.,https://example.com/?brave_popup=42), iterating through the WordPress post ID sequence. - Extract popup content: For each ID that returns rendered popup HTML in the page
<head>, parse the response to extractpopup_datametadata, which may include draft campaign content, coupon codes, form configurations, or integration endpoints. - Bypass targeting rules: Because the preview branch forces all targeting conditions (
userTypeMatch,refererMatch,countryMatch, etc.) totrue, any popup — regardless of its audience restrictions — will render for the authenticated attacker (WPScan).
Indicadores de compromisso
- Network: Repeated GET requests to the site's front-end URLs containing the
?brave_popup=query parameter with sequentially or randomly varying integer values from a single authenticated session. - Logs: WordPress access logs showing a pattern of requests like
GET /?brave_popup=<id>from the same authenticated user across many different post IDs in a short time window. - Application Behavior: Unusual rendering of popup HTML in page
<head>responses for non-popup pages, particularly for draft or restricted-status posts, visible in server-side debug or audit logs if enabled.
Mitigação e soluções alternativas
The vendor has released Brave Popup Builder version 0.8.6, which addresses this vulnerability. Site administrators should update the plugin immediately via the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository. As a temporary workaround prior to patching, administrators can restrict site registration to prevent untrusted users from obtaining Subscriber-level accounts, or disable the plugin until the update can be applied. Proper remediation requires adding capability and post_status checks to the bravepop_render_popup() function in lib/render.php (WPScan, GitHub Advisory).
Reações da comunidade
The vulnerability was discovered and reported by independent researcher Huseyin Mertoglu, who published a detailed write-up at their personal site. WPScan verified and published the advisory, noting the distinction from the previously patched CVE-2025-68508. The CVE was noted on Bluesky via automated CVE tracking accounts shortly after disclosure. No significant broader media coverage or vendor statements beyond the WPScan advisory have been observed (WPScan).
Recursos adicionais
Origem: Este relatório foi gerado usando IA
Relacionado WordPress Vulnerabilidades:
Avaliação de vulnerabilidade gratuita
Compare sua postura de segurança na nuvem
Avalie suas práticas de segurança na nuvem em 9 domínios de segurança para comparar seu nível de risco e identificar lacunas em suas defesas.
Marque uma demonstração personalizada
Pronto para ver a Wiz em ação?
"A melhor experiência do usuário que eu já vi, fornece visibilidade total para cargas de trabalho na nuvem."
David EstlickCISO
"A Wiz fornece um único painel de vidro para ver o que está acontecendo em nossos ambientes de nuvem."
Adam FletcherDiretor de Segurança
"Sabemos que se a Wiz identifica algo como crítico, na verdade é."
Greg PoniatowskiChefe de Gerenciamento de Ameaças e Vulnerabilidades