CVE-2025-14799

Brevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling

2026-02-17 00:00
ISMAILSHADOW

Strategic Overview

Status
Patched in 3.3.1
Affected Plugin
Brevo – Email, SMS, Web Push, Chat, and more.
Affected Version
<= 3.3.0
CVSS
6.5Medium
Weakness type
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
CVE
CVE-2025-14799
View all Brevo – Email, SMS, Web Push, Chat, and more. vulnerabilities

At a glance

CVE-2025-14799 is a medium-severity Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in the Brevo WordPress plugin, affecting versions <= 3.3.0. It carries a CVSS score of 6.5 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 3.3.1; sites on affected versions should update now. Disclosed February 2026, reported by ISMAILSHADOW.

Vulnerability Overview

The Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress is vulnerable to authorization bypass due to type juggling in all versions up to, and including, 3.3.0. This is due to the use of loose comparison (==) instead of strict comparison (===) when validating the installation ID in the `/wp-json/mailin/v1/mailin_disconnect` REST API endpoint. This makes it possible for unauthenticated attackers to disconnect the Brevo integration, delete the API key, remove all subscription forms, and reset plugin settings by sending a boolean `true` value for the `id` parameter, which bypasses the authorization check through PHP type juggling.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Remediation

Update to version 3.3.1, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Brevo 3.3.1 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2025-14799https://www.wordfence.com/threat-intel/vulnerabilities/id/f29e5b19-2505-4b02-92c7-071833de6bc2https://nvd.nist.gov/vuln/detail/CVE-2025-14799

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C