PT-2026-20382 · WordPress · Brevo – Email

Ismailshadow · Publicado 2026-02-18 · Atualizado 2026-02-18 · CVE-2025-14799

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress versions up to and including 3.3.0

Description The Brevo plugin for WordPress has an authorization bypass issue caused by type juggling. This occurs because of the use of loose comparison (==) instead of strict comparison (===) when validating the installation ID. An unauthenticated attacker can exploit this by sending a boolean true value for the id parameter to the /wp-json/mailin/v1/mailin disconnect API endpoint. Successful exploitation allows attackers to disconnect the Brevo integration, delete the API key, remove all subscription forms, and reset plugin settings. The vulnerable parameter is id.

Recommendations Update the Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress to a version later than 3.3.0.

Correção

Type Confusion

Enumeração de Fraquezas

CWE-843

Identificadores relacionados

CVE-2025-14799

Produtos afetados

Brevo – Email

Referências · 9

• https://wordfence.com/threat-intel/vulnerabilities/id/f29e5b19-2505-4b02-92c7-071833de6bc2?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/mailin/tags/3.2.9/sendinblue.php#L1795 · Nota
• https://twitter.com/CVEnew/status/2024090423820476656 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14799 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2024105299502624823 · Publicação no Twitter
• https://t.me/CVEtracker/44968 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/mailin/tags/3.2.9/sendinblue.php#L1833 · Nota
• https://plugins.trac.wordpress.org/changeset/3448639 · Nota
• https://t.me/cveNotify/152307 · Publicação no Telegram