CVE-2025-14799: Brevo WordPress Plugin Auth Bypass Flaw

CVE-2025-14799 Overview

The Brevo - Email, SMS, Web Push, Chat, and more plugin for WordPress contains an authorization bypass vulnerability caused by PHP type juggling in the REST API endpoint. This vulnerability affects all versions up to and including 3.3.0, allowing unauthenticated attackers to disconnect the Brevo integration, delete API keys, remove subscription forms, and reset plugin settings by exploiting loose comparison operators in the authorization check.

Critical Impact

Unauthenticated attackers can completely disrupt Brevo email marketing integration by disconnecting services, deleting API keys, and resetting all plugin configurations without any authentication.

Affected Products

• Brevo - Email, SMS, Web Push, Chat, and more plugin for WordPress versions up to and including 3.3.0
• WordPress installations with the vulnerable Brevo (formerly Sendinblue) plugin
• All websites using the /wp-json/mailin/v1/mailin_disconnect REST API endpoint

Discovery Timeline

• 2026-02-18 - CVE CVE-2025-14799 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-14799

Vulnerability Analysis

This authorization bypass vulnerability stems from improper type handling in PHP when validating user-supplied installation IDs. The vulnerable code resides in the sendinblue.php file, specifically within the REST API endpoint handler for /wp-json/mailin/v1/mailin_disconnect. When processing disconnect requests, the plugin uses a loose comparison operator (==) instead of a strict comparison operator (===) to validate the installation ID parameter.

PHP's loose comparison behavior allows type juggling, where values of different types can be considered equal. In this case, when a boolean true value is sent as the id parameter, PHP's loose comparison evaluates true == $installation_id as truthy for any non-empty, non-zero installation ID string. This effectively bypasses the authorization check that should prevent unauthorized users from disconnecting the Brevo integration.

The impact of successful exploitation includes disconnection of the Brevo marketing integration, deletion of stored API keys, removal of all configured subscription forms, and complete reset of plugin settings—causing significant disruption to email marketing operations.

Root Cause

The root cause is the use of loose comparison (==) instead of strict comparison (===) when validating the id parameter against the stored installation ID in the /wp-json/mailin/v1/mailin_disconnect REST API endpoint. This type confusion vulnerability (CWE-843) allows attackers to bypass authorization by sending a boolean true value that passes the loose equality check regardless of the actual installation ID value.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the vulnerable REST API endpoint (/wp-json/mailin/v1/mailin_disconnect) with the id parameter set to a boolean true value. Because PHP's loose comparison evaluates true == "any_string" as truthy, this bypasses the installation ID validation check, granting the attacker unauthorized access to disconnect the Brevo integration and reset plugin configurations.

The vulnerability can be exploited by sending a JSON payload containing {"id": true} to the disconnect endpoint. The loose comparison in the authorization logic then incorrectly validates this boolean value against the stored string installation ID, allowing the disconnect operation to proceed without proper authorization.

Detection Methods for CVE-2025-14799

Indicators of Compromise

• Unexpected disconnection of the Brevo integration without administrator action
• Missing or deleted Brevo API keys in plugin settings
• Subscription forms suddenly removed from the website
• Plugin configuration reset to default values
• Unusual HTTP requests to /wp-json/mailin/v1/mailin_disconnect endpoint in access logs

Detection Strategies

• Monitor access logs for POST requests to the /wp-json/mailin/v1/mailin_disconnect endpoint from unauthorized sources
• Implement web application firewall (WAF) rules to detect requests with boolean values in JSON payloads to REST API endpoints
• Enable WordPress REST API logging to track all requests to mailin namespace endpoints
• Set up alerts for configuration changes to the Brevo plugin

Monitoring Recommendations

• Configure SentinelOne Singularity to monitor for suspicious REST API activity on WordPress installations
• Implement file integrity monitoring on the Brevo plugin configuration files
• Review access logs regularly for patterns indicating exploitation attempts
• Monitor for unauthorized changes to plugin settings through WordPress hooks

How to Mitigate CVE-2025-14799

Immediate Actions Required

• Update the Brevo plugin to a version newer than 3.3.0 immediately
• Audit recent access logs for any exploitation attempts targeting the vulnerable endpoint
• Verify Brevo integration status and re-configure if disconnection occurred
• Regenerate Brevo API keys if there is any suspicion of unauthorized access

Patch Information

The vulnerability has been addressed in versions after 3.3.0 of the Brevo plugin. The fix involves replacing the loose comparison operator (==) with a strict comparison operator (===) when validating the installation ID parameter. For detailed information about the code changes, see the WordPress Plugin Changeset. The Wordfence Vulnerability Report provides additional details about this vulnerability.

Workarounds

• Temporarily restrict access to the /wp-json/mailin/v1/mailin_disconnect endpoint via web server configuration or WAF rules until the plugin can be updated
• Implement IP-based access controls to limit REST API access to trusted networks
• Use a security plugin to add additional authorization checks on REST API endpoints
• Consider temporarily deactivating the Brevo plugin if an immediate update is not possible

# Apache .htaccess configuration to block vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/mailin/v1/mailin_disconnect [NC]
RewriteRule .* - [F,L]
</IfModule>