CVE-2025-14799: Brevo WordPress Plugin Auth Bypass Flaw

CVE-2025-14799 Overview

CVE-2025-14799 is an authorization bypass vulnerability in the Brevo plugin for WordPress (formerly Sendinblue), which provides email, SMS, web push, chat, and marketing automation. The flaw exists in all versions up to and including 3.3.0. The /wp-json/mailin/v1/mailin_disconnect REST API endpoint uses loose comparison (==) instead of strict comparison (===) when validating the installation ID. Unauthenticated attackers can exploit PHP type juggling to bypass the authorization check by sending a boolean true value for the id parameter. Successful exploitation disconnects the Brevo integration, deletes the API key, removes subscription forms, and resets plugin settings.

Critical Impact
Unauthenticated attackers can remotely disconnect the Brevo integration, delete API credentials, and reset plugin configuration on affected WordPress sites.

Affected Products

Brevo - Email, SMS, Web Push, Chat, and more plugin for WordPress (versions <= 3.3.0)
WordPress sites using the mailin plugin (Sendinblue/Brevo)
All deployments exposing the /wp-json/mailin/v1/mailin_disconnect REST endpoint

Discovery Timeline

2026-02-18 - CVE-2025-14799 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14799

Vulnerability Analysis

The vulnerability is a type confusion flaw classified under [CWE-843] (Access of Resource Using Incompatible Type). The Brevo plugin exposes a REST API endpoint at /wp-json/mailin/v1/mailin_disconnect intended to disconnect the integration. The endpoint validates the request by comparing a supplied id parameter against the stored installation ID. The comparison uses PHP's loose equality operator (==), which performs automatic type coercion before comparing values. When PHP compares a boolean true against any non-empty, non-zero string using ==, it returns true, regardless of the string contents. An attacker exploiting this behavior bypasses the authorization gate entirely.

Root Cause

The root cause is the use of loose comparison (==) instead of strict comparison (===) when validating the installation ID inside the disconnect handler. Loose comparison in PHP coerces operands of different types, allowing a boolean value to match an arbitrary non-empty string. Strict comparison would require both type and value to match, eliminating the bypass.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the /wp-json/mailin/v1/mailin_disconnect REST endpoint with the id parameter set to a boolean true value, for example via a JSON body containing {"id": true}. The plugin evaluates true == $stored_installation_id as true and proceeds to execute the disconnect routine. The routine deletes the stored API key, removes all subscription forms, and resets plugin settings. See the Wordfence Threat Intelligence Report and WordPress Plugin Source at line 1795 for the vulnerable code path.

Detection Methods for CVE-2025-14799

Indicators of Compromise

HTTP POST requests to /wp-json/mailin/v1/mailin_disconnect from unauthenticated sources, particularly with JSON payloads containing "id": true or non-string id values.
Unexpected disappearance of the Brevo API key in plugin settings or sudden disconnection of the Brevo integration.
Removal of all Brevo subscription forms and reset of plugin options without an administrator action in the audit log.

Detection Strategies

Inspect web server access logs and WordPress request logs for requests to the mailin_disconnect REST route originating from non-administrative IP addresses.
Monitor the wp_options table for unexpected writes that clear Brevo-related option keys.
Alert on REST API requests where the id parameter is a JSON boolean rather than a string or integer.

Monitoring Recommendations

Enable WordPress audit logging for plugin settings changes and REST API access.
Forward web access logs to a centralized analytics platform and build queries targeting the /wp-json/mailin/v1/ namespace.
Track plugin configuration state changes to detect unauthorized resets of subscription forms and API credentials.

How to Mitigate CVE-2025-14799

Immediate Actions Required

Update the Brevo plugin to a version newer than 3.3.0 that includes the fix from WordPress Changeset #3448639.
Rotate the Brevo API key if there is any indication the disconnect endpoint was triggered without authorization.
Audit subscription forms and plugin settings, and restore from backup if unauthorized resets occurred.

Patch Information

The vendor addressed the issue by replacing the loose comparison with a strict comparison in the disconnect handler. The fix is published as WordPress Changeset #3448639. Site administrators should upgrade to the latest available Brevo plugin release through the WordPress plugin manager.

Workarounds

Block public access to /wp-json/mailin/v1/mailin_disconnect at the web application firewall or reverse proxy layer until the plugin is updated.
Restrict WordPress REST API access to authenticated administrators using a security plugin or custom rest_authentication_errors filter.
Temporarily deactivate the Brevo plugin if patching is not immediately possible and the disconnect endpoint cannot be filtered.

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~ ^/wp-json/mailin/v1/mailin_disconnect {
    deny all;
    return 403;
}