CVE-2026-77116 — Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

CVE-2026-77116

Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview PUBLISHED

Description (CNA)

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.

Affected (CNA)

Vendor / product	Versions
Unknown / Brave	affected 0 before 0.8.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/db0a775c-cbac-4918-8b10-75f4fb2d716a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.