The vulnerability in the Bricks Theme 2.4 and earlier allows anyone to read draft and unpublished page content by calling the REST endpoint /wp-json/bricks/v1/load_popup_content with a popupId parameter. Readers can first retrieve a public nonce through the bricks_regenerate_query_nonce action, then increment popupId values to enumerate and disclose confidential content from any unpublished post. The broken access control means that no authentication or capability check is performed, so anonymous attackers can gain access to data that should remain private. This leads to a direct breach of confidentiality for site owners who keep drafts or unpublished material containing sensitive information.

WordPress sites using the Bricks Theme 2.4 or any prior release. The CVE explicitly references Bricks Theme 2.4 and earlier; the recent 2.4.1 release is implied to contain the fix. No other vendor or product variants are indicated.

The CVSS score of 7.5 indicates a high impact, and the absence of an EPSS score or KEV listing suggests the exploit is not yet widely observed but remains feasible. Attackers need only network access to the site and can perform the exploitation without any credentials, relying on the REST endpoint and the publicly available nonce. Enumerating popup IDs is straightforward and risks expose confidential draft content. The threat is significant for sites that rely on the theme to protect unpublished material, and the lack of authentication checks makes the attack vector simple and low-hanging.