A broken access control flaw exists in Brave Popup Builder versions up to and including 0.8.5. Any logged‑in user, such as a Subscriber or WooCommerce Customer, can view popup content that should remain unpublished by simply adding a post ID to the page URL. The vulnerability exposes confidential popup data to unauthorized users, thereby compromising the confidentiality of the site’s content. It does not provide code execution, privilege escalation, or denial of service.

WordPress installations that use the Brave Popup Builder plugin, version 0.8.5 or earlier. The flaw affects all sites that have not upgraded the plugin to version 0.8.6 or later. No specific vendor name is available beyond the plugin identifier.

The exploit requires only that an attacker be authenticated as any user on the site and that they can manipulate the URL to include a post ID. Attack complexity is low and no additional privileges are required. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation to date. The lack of a public exploit does not reduce the importance of remediation, however the straightforward nature of the attack vector makes the risk moderate.