Broken Access Control in Brave Popup Builder

Executive Summary

Brave Popup Builder versions through 0.8.5 have an Insecure Direct Object Reference (IDOR) vulnerability. Any logged-in user, including Subscribers or WooCommerce Customers, can access unpublished popup content by modifying the URL with a post ID parameter. The vulnerability occurs in the bravepop_render_popup() function which does not verify user permissions or post status before displaying content.

Useful 0 Not Useful 0

Detection Guidance

Check if the Brave Popup Builder plugin version is 0.8.5 or lower. Inspect network traffic for requests containing the 'brave_popup' parameter in the URL. Look for unauthorized access to popup content by logged-in users with non-admin roles.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to view sensitive popup content such as draft campaigns, restricted promotions, coupon codes, or integration endpoints. Attackers can iterate through post IDs to access unpublished or protected popups, potentially exposing confidential information or unreleased marketing materials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may lead to unauthorized access to sensitive data, which could violate GDPR (if personal data is exposed) or HIPAA (if health-related information is compromised). Organizations must ensure proper access controls to maintain compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Brave Popup Builder plugin to version 0.8.6 or later immediately. Remove or restrict access for non-admin users to the 'brave_popup' parameter functionality. Review popup content permissions and ensure only authorized users can access unpublished or restricted popups.

Useful 0 Not Useful 0