Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2026-77116
CVE-2026-77116:
WordPress vulnerability analysis and mitigation
Overview
CVE-2026-77116 is a broken access control (IDOR) vulnerability in the Brave Popup Builder WordPress plugin (slug: brave-popup-builder) that allows any authenticated user — including those with Subscriber or WooCommerce Customer roles — to read restricted popup content by manipulating a post ID in the URL. It affects all versions through 0.8.5, with version 0.8.6 introducing the fix. The vulnerability was publicly disclosed on August 21, 2026, and assigned by WPScan. WPScan classifies it with a CVSS score of 4.3 (Medium), while Feedly estimates it as HIGH severity (WPScan, GitHub Advisory).
Technical details
The root cause is a missing authorization check in the bravepop_render_popup() function located in lib/render.php, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). This function is hooked to wp_head at priority 9 and, when the brave_popup query parameter is present, only verifies is_user_logged_in() — performing no capability check, ownership check, or post_status validation. An attacker can enumerate WordPress post IDs via ?brave_popup={id} to retrieve draft, pending, private, or scheduled popup content, as well as bypass all targeting rules (geo, UTM, referrer, audience filters) since the preview branch forces all match conditions to true. This is a distinct and separate vulnerability from CVE-2025-68508, which was an unauthenticated AJAX-based bypass fixed in version 0.8.4; the GET-based preview path in lib/render.php was never patched in that release (WPScan).
Impact
Successful exploitation allows any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) to read popup content that should be restricted, including draft campaigns, unreleased promotional content, coupon codes not yet intended for public use, hidden form fields, and potentially integration endpoints or newsletter list IDs embedded in popup configuration data. Because the preview branch bypasses all audience targeting rules, even published popups restricted by geo-location, UTM parameters, referrer, or other conditions can be exposed. While this vulnerability does not enable code execution or privilege escalation, it poses a meaningful confidentiality risk for businesses using the plugin to manage sensitive marketing campaigns or gated content (WPScan).
Exploitability
There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time; WPScan has indicated the PoC will be published on September 4, 2026, to allow time for users to update. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid WordPress login (Subscriber-level or above), making the attack surface relatively broad on sites with open registration or WooCommerce storefronts (WPScan, GitHub Advisory).
Exploitation steps
- Obtain low-privilege access: Register or log in to the target WordPress site as a Subscriber or WooCommerce Customer — no elevated permissions are required.
- Identify the target site: Confirm the site uses the Brave Popup Builder plugin (version ≤ 0.8.5) by checking plugin indicators in page source or HTTP headers.
- Enumerate post IDs: Craft GET requests to the site's front end appending
?brave_popup={id}with incrementing integer values (e.g.,https://example.com/?brave_popup=42), iterating through the WordPress post ID sequence. - Extract popup content: For each ID that returns rendered popup HTML in the page
<head>, parse the response to extractpopup_datametadata, which may include draft campaign content, coupon codes, form configurations, or integration endpoints. - Bypass targeting rules: Because the preview branch forces all targeting conditions (
userTypeMatch,refererMatch,countryMatch, etc.) totrue, any popup — regardless of its audience restrictions — will render for the authenticated attacker (WPScan).
Indicators of compromise
- Network: Repeated GET requests to the site's front-end URLs containing the
?brave_popup=query parameter with sequentially or randomly varying integer values from a single authenticated session. - Logs: WordPress access logs showing a pattern of requests like
GET /?brave_popup=<id>from the same authenticated user across many different post IDs in a short time window. - Application Behavior: Unusual rendering of popup HTML in page
<head>responses for non-popup pages, particularly for draft or restricted-status posts, visible in server-side debug or audit logs if enabled.
Mitigation and workarounds
The vendor has released Brave Popup Builder version 0.8.6, which addresses this vulnerability. Site administrators should update the plugin immediately via the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository. As a temporary workaround prior to patching, administrators can restrict site registration to prevent untrusted users from obtaining Subscriber-level accounts, or disable the plugin until the update can be applied. Proper remediation requires adding capability and post_status checks to the bravepop_render_popup() function in lib/render.php (WPScan, GitHub Advisory).
Community reactions
The vulnerability was discovered and reported by independent researcher Huseyin Mertoglu, who published a detailed write-up at their personal site. WPScan verified and published the advisory, noting the distinction from the previously patched CVE-2025-68508. The CVE was noted on Bluesky via automated CVE tracking accounts shortly after disclosure. No significant broader media coverage or vendor statements beyond the WPScan advisory have been observed (WPScan).
Additional resources
Source: This report was generated using AI
Related WordPress vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management