What is the CVSS score of CVE-2026-14956?

CVE-2026-14956 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Bricksforge are affected by CVE-2026-14956?

The Bricksforge WordPress plugin (versions 3.1.8.6 and below) allows unauthenticated remote attackers to create administrator accounts on affected websites, providing complete unauthorized access.

How to fix or mitigate CVE-2026-14956?

Within 24 hours: Identify all WordPress installations running Bricksforge version 3.1.8.6 or earlier and immediately disable the Pro Forms User Registration feature or deactivate the entire plugin. Within 7 days: Audit all administrator accounts created in the past 90 days to identify and remove any unauthorized accounts; reset passwords for all existing administrator accounts; and implement Web Application Firewall rules to block requests to the vulnerable registration endpoint. Within 30 days: Continuously monitor Bricksforge's official security advisories for a vendor patch; if no patch is released, evaluate and implement an alternative form-building plugin that meets your security requirements; and consider permanent removal of Bricksforge from your WordPress environment.

Bricksforge CVE-2026-14956

EUVD-2026-45123 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-17 Wordfence

GHSA-3h83-c8w5-cccx

WordPress Privilege Escalation Bricksforge

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, single-request administrator creation with no user interaction yields AV:N/AC:L/PR:N/UI:N and full C/I/A impact; the public-form prerequisite is a config precondition, not attack complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 02:00 vuln.today

CVE Published

Jul 17, 2026 - 01:30 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.

Articles & Coverage 1

News Critical Privilege Escalation in WordPress Bricksforge Plugin ≤3.1.8.6 - CVE-2026-14956 Jul 17, 2026

AnalysisAI

Unauthenticated privilege escalation in the Bricksforge WordPress plugin (versions ≤ 3.1.8.6) lets remote attackers create a new administrator account by abusing the Pro Forms User Registration action. The plugin fails to validate the fieldIds parameter, so attacker-supplied field IDs are injected into the trusted form-field whitelist, enabling mass-assignment of a privileged role. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable (CVSS 9.8) on any site exposing a Pro Forms registration element.

Technical ContextAI

Bricksforge is a commercial add-on for the Bricks visual site builder on WordPress, providing 'Pro Forms' - advanced form elements including a User Registration action that maps submitted form fields to WordPress user meta and account properties. The root cause is CWE-269 (Improper Privilege Management): the registration handler trusts a client-supplied fieldIds parameter to determine which fields are permitted, effectively letting the attacker extend the server-side allowlist. Because WordPress user creation maps arbitrary meta/role fields, an attacker can add the wp_capabilities / role field to the whitelist and set it to 'administrator' during self-registration - a classic mass-assignment via broken authorization. The affected component is identified by CPE cpe:2.3:a:bricksforge:bricksforge:*:*:*:*:*:*:*:* covering all versions through 3.1.8.6.

RemediationAI

Upgrade Bricksforge to a fixed release above 3.1.8.6 as published in the vendor changelog (https://bricksforge.io/version-changelog/); the input does not specify an exact patched version number, so treat this as 'Patch available per vendor advisory' and confirm the fixed build against the changelog before deploying. As an immediate compensating control until patched, unpublish or remove any public Bricksforge Pro Forms element that uses the User Registration action - this fully closes the attack surface but disables self-service registration on affected forms. Where registration must remain available, restrict access to those form endpoints (for example gate the page behind authentication or IP allow-listing) and audit existing WordPress users for unexpected administrator accounts created recently, since exploitation results in a rogue admin. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/d0538778-5ba4-4bec-a89d-ef90a9ba8375) for detection guidance.