Technical impact
The Brevo plugin for WordPress contains an authorization bypass flaw caused by PHP type juggling when validating the installation ID on the /wp-json/mailin/v1/mailin_disconnect REST endpoint. The code uses a loose comparison (==) instead of a strict comparison (===), so an unauthenticated user can supply the boolean true value for the id parameter. This bypasses the authorization check, allowing the attacker to disconnect the Brevo integration, delete the API key, remove all subscription forms, and reset plugin settings. The weakness is classified as CWE-843: Type Confusion. The impact includes loss of access to the mail service for the site and disruption of automated email, SMS, push, and chat notifications.
Affected Systems
The vulnerability affects all versions of the Brevo – Email, SMS, Web Push, Chat, and more. plugin for WordPress up to and including version 3.3.0. No specific WordPress core or other plugin version constraints are listed.
Risk and Exploitability
The CVSS score is 6.5, indicating a medium severity. The EPSS score is less than 1%, meaning exploitation is considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the publicly exposed REST API endpoint. An attacker does not need authentication or any other privileges to trigger the bypass, so the risk remains significant in environments that expose the endpoint to the internet.
