The vulnerability arises from a broken access control mechanism in the Bricks Builder REST API endpoint /wp-json/bricks/v1/query_result. By sending a crafted POST request that includes specific post_status and post_type values in the originalQueryVars parameter, an unauthenticated attacker can leverage a publicly obtainable nonce to retrieve content that is normally protected. This can expose draft or private posts as well as WooCommerce coupon data that are not intended for public viewing. The weakness is a classic unauthorized access flaw (CWE-862).

WordPress sites that utilize the Bricks Builder plugin, specifically versions 2.4.3 and earlier, are affected. These installations expose the /wp-json/bricks/v1/query_result endpoint to unauthenticated users, allowing the data leakage described above.

The CVSS score of 7.5 indicates a high risk to confidentiality, with no countermeasures in place apart from authentication. The lack of an EPSS score means the exploitation probability is not quantified, yet the vulnerability is publicly documented and can be exploited using only a standard POST request, a public nonce, and crafted parameters. Because of this simplicity, the risk is moderate to high and the attacker does not need privileged access or sophisticated conditions. Since the vulnerability is not yet listed in the CISA KEV catalog, it is still outside the known exploited set, but the exposure potential warrants immediate action.