Bricks Theme CVE-2026-118803

No special conditions beyond running a vulnerable version - remote unauthenticated exploitation against default configurations of Bricks Theme 2.4.3 and earlier, where the query_result REST endpoint accepts attacker-controlled urlParams and re-parses them as dynamic data tags. No authentication, user interaction, or non-default setting is required per the CVSS vector (PR:N/UI:N) and description. The only material limiter is version: sites updated to Bricks 2.4.4 are not affected. Impact is confidentiality-only (password hash, email, post meta disclosure); the flaw does not itself provide write or code-execution primitives per the available data.

All available signals point to a genuine, high-priority issue rather than a CVSS-inflated non-event. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) describes a network-reachable, low-complexity, unauthenticated path to high-confidentiality impact, and the description corroborates the vector exactly: an anonymous attacker controls the urlParams object in the query_result REST endpoint and the value is re-parsed as a Bricks dynamic data tag, leaking the post author's user record including the password hash. There is no CVSS/description conflict - the network, no-auth, no-interaction claims are internally consistent. No EPSS score and no CISA KEV entry are present in the input, so widespread or confirmed active exploitation cannot be asserted; the vuln.today Decision label is 'this_week', indicating prompt but not emergency remediation. The reporting source is VulnCheck (a credible research vendor), and a fixed release (2.4.4) exists, but there is no confirmed working public exploit at this time. Net: a real, directly actionable information-disclosure flaw whose exposure of password hashes makes it serious despite the absence of KEV/EPSS data - treat it as a priority patch, not a theoretical high-CVSS finding.

An anonymous attacker sends a crafted request to the Bricks query_result REST endpoint, supplying a urlParams value that Bricks re-parses as a dynamic data tag (e.g. author_meta:user_pass or author_meta:user_email). The server resolves the injected tag and returns the post author's user record - including the password hash - in the response, all without authentication or user interaction. No confirmed working public exploit is identified at time of analysis, though VulnCheck has published an advisory describing the technique.