Brave Popup Builder Authenticated IDOR Unpublished Popup Disclosure via Preview (CVE-2026-77116)

Vulnerability Overview Vulnerability Name: Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview Vulnerability Description: Brave Popup Builder (slug: brave-popup-builder) contains an access control issue in versions 0.8.5 and earlier. Any logged-in user (Subscriber or WooCommerce Customer) can read popup content they should not have access to by passing a post ID in the URL. Scope of Impact Affected Plugin: Plugin Name: brave-popup-builder Affected Versions: < 0.8.6 Vulnerability Type: Type: IDOR (Insecure Direct Object Reference) OWASP Top 10: A5: Broken Access Control CWE: CWE-639 CVSS Score: 4.3 (medium) Remediation Fixed Version: Fixed Version: 0.8.4 and above Remediation Details: CVE-2025-68508 was fixed in version 0.8.4 (changelog: "Draft Popup Content could be loaded by anyone using custom Javascript", CVSS 5.3). This vulnerability was not registered via . The 0.8.4 patch added gating and a check, but only for the AJAX handler. This issue (in 0.8.5) persists. The block in was only partially addressed by the 0.8.4 security release, which touched the AJAX handler in that file. The GET preview branch never received capability or checks and remains accessible to Subscribers. Additional Information CVE Number: CVE-2026-77116 Reference Links: https://huseyinmertoglu.com/vulnerability/brave-popup-builder-authenticated-idor/ Timeline: Public Disclosure Date: 2026-08-21 Addition Date: 2026-08-21 Last Update Date: 2026-08-21 Original Researcher: Researcher: Huseyin Mertoglu Submitter: Submitter: Huseyin Mertoglu Submitter Website: https://huseyinmertoglu.com Submitter Twitter: mertoglu63 Verification Status: Verification: Yes WPVDB ID: ID: db0a775c-cbac-4918-8b10-75f4fb2d716a Proof of Concept (PoC) PoC Code: Classification Classification Information: Type: IDOR OWASP Top 10: A5: Broken Access Control CWE: CWE-639 CVSS: 4.3 (medium) Others Related Vulnerabilities: 2026-07-29: PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR 2025-11-29: StreamTube Core < 4.79 - Unauthenticated Arbitrary User Password Change 2024-03-29: Whizzy <= 1.1.18 - Authenticated [Subscriber+] Insecure Direct Object Reference 2024-03-18: Permalink Manager < 2.4.3.2 - Missing Authorization to Authenticated[Author+] arbitrary post slug modification 2022-11-16: Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR Footer Information Partners: Partner: Jetpack Company Information: Company: AUTOMATTIC Careers: Work With Us News: Press Social Media: Twitter: @ Facebook: @ LinkedIn: @ Privacy Policy: Privacy Policy: Privacy Terms of Service: Terms of service Submission Terms: Submission terms Disclosure Policy: Disclosure policy Privacy Notice for California Users: Privacy Notice for California Users Contact Information: Contact Us: Contact Developer Information: Status: Status API Details: API details CLI Scanner: CLI scanner WordPress Plugin Information: WordPress: WordPress Plugins: Plugins Themes: Themes Our Stats: Our Stats Submit Vulnerabilities: Submit vulnerabilities About Information: How It Works: How it works Pricing: Pricing WordPress Plugin: WordPress plugin Blog: Blog Other Information: Privacy: Privacy Terms of Service: Terms of service Submission Terms: Submission terms Disclosure Policy: Disclosure policy Privacy Notice for California Users: Privacy Notice for California Users Partners: Partner: Jetpack Company Information: Company: AUTOMATTIC Careers: Work With Us News: Press Social Media: Twitter: @ Facebook: @ LinkedIn: @ Privacy Policy: Privacy Policy: Privacy Terms of Service: Terms of service Submission Terms: Submission terms Disclosure Policy: Disclosure policy Privacy Notice for California Users: Privacy Notice for California Users Contact Information: Contact Us: Contact Developer Information: Status: Status API Details: API details CLI Scanner: CLI scanner WordPress Plugin Information: WordPress: WordPress Plugins: Plugins Themes: Themes Our Stats: Our Stats Submit Vulnerabilities: Submit vulnerabilities About Information: How It Works: How it works Pricing: Pricing WordPress Plugin: WordPress plugin Blog: Blog Other Information: Privacy: Privacy Terms of Service: Terms of service Submission Terms: Submission terms Disclosure Policy: Disclosure policy Privacy Notice for California Users: Privacy Notice for California Users

Goal Reached Thanks to every supporter — we hit 100%!

Brave Popup Builder Authenticated IDOR Unpublished Popup Disclosure via Preview (CVE-2026-77116)

More from this source