What is the CVSS score of CVE-2026-14956?

CVE-2026-14956 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-14956?

Within 24 hours: Identify all WordPress installations running Bricksforge version 3.1.8.6 or earlier and immediately disable the Pro Forms User Registration feature or deactivate the entire plugin. Within 7 days: Audit all administrator accounts created in the past 90 days to identify and remove any unauthorized accounts; reset passwords for all existing administrator accounts; and implement Web Application Firewall rules to block requests to the vulnerable registration endpoint. Within 30 days: Continuously monitor Bricksforge's official security advisories for a vendor patch; if no patch is released, evaluate and implement an alternative form-building plugin that meets your security requirements; and consider permanent removal of Bricksforge from your WordPress environment.

Bricksforge CVE-2026-14956

EUVD-2026-45123 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-17 Wordfence

GHSA-3h83-c8w5-cccx

WordPress Privilege Escalation Bricksforge

9.8

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify public Bricksforge Pro Forms registration form
Delivery

Craft request injecting role field into fieldIds
Exploit

Submit to registration action endpoint
Execution

Bypass field whitelist validation
Persist

Register new administrator account
Impact

Full WordPress site takeover

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the target site has a publicly accessible Bricksforge Pro Forms element configured with the User Registration action - this specific feature/configuration is the mandatory precondition and sites without such a form are not exploitable despite running a vulnerable version. Given that prerequisite, no authentication, user interaction, or special client state is needed: an unauthenticated remote attacker submits a single crafted request manipulating the fieldIds parameter. The limiting factor is therefore purely the presence and public exposure of a registration-enabled Pro Forms element, not any privilege or platform requirement.
Impact	This is a genuine high priority, not an inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) is internally consistent: fully remote, no authentication, no user interaction, and full site compromise via administrator takeover. The signals are unusually clean and mutually reinforcing - network reachable, low complexity, and total control of the target WordPress instance once an admin account is created. EPSS and CISA KEV data were not supplied in the input, so exploitation-probability and active-exploitation status are UNKNOWN rather than low - absence of data is not evidence of low risk. No POC was provided. The one meaningful limiting factor that does NOT appear in the CVSS score is a deployment prerequisite: the site must have a publicly accessible Pro Forms element configured with the User Registration action, so not every installation is exploitable even though every version is vulnerable.
Exploit ScenarioDerived	An attacker locates a WordPress site running Bricksforge with a public Pro Forms registration form, then submits a crafted registration request that adds a role/capabilities field ID to the fieldIds parameter and sets its value to administrator. The server accepts the manipulated whitelist and provisions a new administrator account, giving the unauthenticated attacker full control of the site. No public POC is referenced, but the low attack complexity means weaponization would be straightforward.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 17, 2026

Unauthenticated privilege escalation in the Bricksforge WordPress plugin (versions ≤ 3.1.8.6) lets remote attackers create a new administrator account by abusing the Pro Forms User Registration action. The plugin fails to validate the fieldIds parameter, so attacker-supplied field IDs are injected into the trusted form-field whitelist, enabling mass-assignment of a privileged role. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable (CVSS 9.8) on any site exposing a Pro Forms registration element.

RemediationAI

Upgrade Bricksforge to a fixed release above 3.1.8.6 as published in the vendor changelog (https://bricksforge.io/version-changelog/); the input does not specify an exact patched version number, so treat this as 'Patch available per vendor advisory' and confirm the fixed build against the changelog before deploying. As an immediate compensating control until patched, unpublish or remove any public Bricksforge Pro Forms element that uses the User Registration action - this fully closes the attack surface but disables self-service registration on affected forms. Where registration must remain available, restrict access to those form endpoints (for example gate the page behind authentication or IP allow-listing) and audit existing WordPress users for unexpected administrator accounts created recently, since exploitation results in a rogue admin. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/d0538778-5ba4-4bec-a89d-ef90a9ba8375) for detection guidance.

Affected VersionsENISA

Bricksforge 0 ≤3.1.8.6

Affected Packages

euvd bricksforge no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Bricksforge is a commercial add-on for the Bricks visual site builder on WordPress, providing 'Pro Forms' - advanced form elements including a User Registration action that maps submitted form fields to WordPress user meta and account properties. The root cause is CWE-269 (Improper Privilege Management): the registration handler trusts a client-supplied fieldIds parameter to determine which fields are permitted, effectively letting the attacker extend the server-side allowlist. Because WordPress user creation maps arbitrary meta/role fields, an attacker can add the wp_capabilities / role field to the whitelist and set it to 'administrator' during self-registration - a classic mass-assignment via broken authorization. The affected component is identified by CPE cpe:2.3:a:bricksforge:bricksforge:*:*:*:*:*:*:*:* covering all versions through 3.1.8.6.

Know when Bricksforge gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Remote, unauthenticated, single-request administrator creation with no user interaction yields AV:N/AC:L/PR:N/UI:N and full C/I/A impact; the public-form prerequisite is a config precondition, not attack complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.

Articles & Coverage 1

News Critical Privilege Escalation in WordPress Bricksforge Plugin ≤3.1.8.6 - CVE-2026-14956 Jul 17, 2026

Executive ViewAI

Why It Matters

The Bricksforge WordPress plugin (versions 3.1.8.6 and below) allows unauthenticated remote attackers to create administrator accounts on affected websites, providing complete unauthorized access. This vulnerability poses an immediate and severe risk to any organization running WordPress sites with this plugin installed. Attackers could steal sensitive data, inject malicious code, or disrupt operations across affected web properties.

Business Impact: Severe

Compensating Controls

Immediately disable Pro Forms User Registration through plugin settings or deactivate the plugin entirely. Implement Web Application Firewall rules to block malicious registration requests. Restrict access to registration forms using IP whitelisting or geofencing. Enable real-time alerts for administrator account creation. Implement mandatory two-factor authentication for all WordPress administrators. Switch to manual user account provisioning through the WordPress admin panel.

Threat Intelligence Overview

EPSS Score

0.4%

Top 73% exploitable

Prevalence

Medium

commercial Bricks builder add-on; common but not ubiquitous WordPress plugin

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.