Medium severity4.3NVD Advisory· Published Aug 23, 2026· Updated Aug 26, 2026

CVE-2026-77116

Description

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Brave Popup Builderllm-fuzzy
Range: <=0.8.5
Package: https://wordpress.org/plugins/brave-popup-builder

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/db0a775c-cbac-4918-8b10-75f4fb2d716a/nvd

News mentions

WordPress Plugins: 25 Vulnerabilities Disclosed, Including Critical Auth Bypass and Code Execution Flaws
Vypr Intelligence · Aug 23, 2026

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000