Brave Popup Builder – Authenticated (Subscriber+) Broken Access Control / Insecure Direct Object Reference (IDOR)

I identified a broken access control vulnerability (Insecure Direct Object Reference) in the Brave Popup Builder (Brave Conversion Engine) WordPress plugin. The popup preview feature renders a popup by ID for any authenticated user while checking only whether the user is logged in — with no capability, ownership, or post-status check. As a result, any low-privileged user (such as a Subscriber or WooCommerce Customer) can read the full content of unpublished popups (draft, pending, private, scheduled) and popups otherwise hidden by targeting rules, simply by supplying a numeric post ID in the URL.

This is a distinct code path from the previously fixed unauthenticated issue (CVE-2025-68508) and remains exploitable on the latest release. It has been responsibly disclosed to the vendor and submitted to the WPScan vulnerability database.