Privilege escalation via improper validation in Bricksforge for WordPress (CVE-2026-14956)

The Bricksforge plugin for WordPress contains an improper validation vulnerability in the fieldIds parameter of the Pro Forms registration action, which permits attacker-supplied field IDs to be inserted into the trusted form-field whitelist. Unauthenticated remote attackers can exploit this flaw to register a new administrator account by submitting a crafted request to a publicly accessible Pro Forms registration form, provided the site has a Bricksforge Pro Forms element configured with the User Registration action. This vulnerability carries a CVSS score of 9.8 (Critical). Affected versions: - <= 3.1.8.6 We recommend updating to: 3.1.8.7. CVSS 9.8 · our assessment: act_now Vendor advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/d0538778-5ba4-4bec-a89d-ef90a9ba8375?source=cve Details: https://vuln.today/cve/CVE-2026-14956