CVE-2026-77116

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-08-23

Last modified

2026-10-12

Weaknesses

CWE-639

Affected products

• Brave (Unknown)

References

• https://wpscan.com/vulnerability/db0a775c-cbac-4918-8b10-75f4fb2d716a/