CVE-2026-77116: Brave Popup Builder Auth Bypass Flaw

CVE-2026-77116 Overview

CVE-2026-77116 is a broken access control vulnerability in the Brave Popup Builder WordPress plugin (slug: brave-popup-builder) affecting versions through 0.8.5. Any authenticated user, including low-privilege roles such as Subscriber or WooCommerce Customer, can read popup content they are not authorized to view. The flaw is triggered by passing a post ID in the URL, allowing enumeration of restricted popup posts. The issue maps to CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated low-privilege users can retrieve confidential popup content by manipulating post ID parameters, exposing internal marketing, gated, or unpublished popup material.

Affected Products

Brave Popup Builder WordPress plugin (brave-popup-builder)
All versions up to and including 0.8.5
WordPress sites with any authenticated user role, including Subscriber and WooCommerce Customer

Discovery Timeline

2026-08-23 - CVE-2026-77116 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77116

Vulnerability Analysis

The Brave Popup Builder plugin exposes popup post content through a request handler that accepts a post ID directly from the URL. The handler retrieves and returns the referenced popup without verifying whether the requesting user has permission to view that specific object. This is a textbook Insecure Direct Object Reference (IDOR) pattern classified under CWE-639.

The vulnerability requires authentication but no elevated role. WordPress sites running WooCommerce commonly grant Customer accounts to anyone completing checkout, which meets the exploitation prerequisite. Impact is limited to confidentiality of popup content; integrity and availability are not affected.

Root Cause

The root cause is missing authorization checks on a post-lookup code path. The plugin trusts the client-supplied post ID and returns popup content without calling a capability check such as current_user_can() against the target object. Object ownership and visibility rules defined by the popup configuration are not enforced server-side.

Attack Vector

An authenticated attacker sends a request to a plugin endpoint and supplies an arbitrary popup post ID in the URL. The plugin returns the popup body regardless of the popup's intended audience, display rules, or draft status. Attackers can iterate through post IDs to enumerate all popup content stored on the site. For technical specifics, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-77116

Indicators of Compromise

Repeated authenticated requests to Brave Popup Builder endpoints with incrementing or varied post ID parameters in the URL query string.
Access to popup content by user accounts holding only Subscriber or WooCommerce Customer roles.
Unusual volumes of admin-ajax.php or plugin REST route hits originating from a single low-privilege session.

Detection Strategies

Review WordPress access logs for authenticated GET requests containing popup post ID parameters and correlate against the requesting user's role.
Alert on sequential post ID enumeration patterns tied to Brave Popup Builder request paths.
Compare the requesting user's capabilities to the popup's intended visibility to identify unauthorized reads.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform to enable role-aware queries across plugin endpoints.
Track Subscriber and WooCommerce Customer accounts that access administrative or content-management endpoints.
Baseline expected plugin traffic and alert on deviations, particularly enumeration-shaped request patterns.

How to Mitigate CVE-2026-77116

Immediate Actions Required

Update Brave Popup Builder to a version above 0.8.5 once a patched release is available from the vendor.
Audit existing WordPress user accounts and remove Subscriber or Customer accounts that are not required.
Review popup content for sensitive material and remove any confidential data stored in popups accessible via the plugin.

Patch Information

At the time of publication, the vendor advisory available is the WPScan Vulnerability Report. Administrators should monitor the plugin's WordPress.org page and vendor channels for a fixed release above version 0.8.5 and apply it as soon as it becomes available.

Workarounds

Disable the Brave Popup Builder plugin until a patched version is released if popups contain sensitive content.
Restrict new user registration and disable open registration on WordPress and WooCommerce to reduce the pool of authenticated attackers.
Deploy a Web Application Firewall (WAF) rule that blocks or challenges requests from low-privilege users targeting plugin endpoints with post ID parameters.

bash

# Example: disable the plugin via WP-CLI until a patch is released
wp plugin deactivate brave-popup-builder