Description
Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Brave | < 0.8.6 | 0.8.6 |
References
- https://wpscan.com/vulnerability/db0a775c-cbac-4918-8b10-75f4fb2d716a/ exploit vdb-entry technical-description