BricksForge CVE-2026-18030

Exploitation requires a WordPress installation running BricksForge before version 3.1.8.8 with at least one published form that uses the BricksForge password update/reset form action configured in update mode. The server-side current-password verification option is disabled by default for this action, meaning the vulnerable state is the default once the form action is deployed - no deliberate misconfiguration is required. Sites running BricksForge but not using its password update form action are not exposed, which provides meaningful segmentation. The target account's username must be known or guessable (e.g., the default 'admin' username, or usernames visible in post author metadata). The CVSS vector PR:N and UI:N confirm that no authentication and no victim interaction are required once the vulnerable form is identified. Exploitation is not constrained by platform, hosting environment, or WordPress version beyond the plugin version requirement.

The CVSS 8.1 High score reflects the maximum confidentiality, integrity, and availability impact against a network-reachable target requiring no privileges or user interaction, with AC:H acknowledging that the specific BricksForge password-update form action must be present and active on the site. That said, AC:H may moderately understate operational risk in practice: once the form action is deployed, the vulnerable state is the default, and targeted attackers identifying the form via page-source inspection or WordPress scanner fingerprinting face low technical friction. EPSS at 0.15% (4th percentile) indicates limited automated exploitation scanning at time of scoring, which is not surprising for a plugin-specific vector not yet indexed by mass scanners; however, a publicly available exploit materially raises near-term targeted exploitation probability. The absence of a CISA KEV listing means mass active exploitation is not yet confirmed, but the combination of a known POC, a trivial bypass of a common self-service feature, and admin-level account-takeover impact means even a mid-sized municipal IT team in opole should treat this as urgent - the barrier to targeted exploitation once a vulnerable form is identified is low. SSVC signals align with Deploy priority: exploitation is not yet automated at scale (Exploitation: POC), the attack is plausibly automatable against known targets (Automatable: Yes), and the technical impact is total (full admin takeover).

An attacker scans for WordPress sites running BricksForge using publicly available WordPress fingerprinting tools, then inspects page source to locate a form using the vulnerable password update action. Using the publicly available exploit, the attacker submits a crafted unauthenticated POST request to the BricksForge form handler specifying a known or guessable username (such as 'admin') alongside an attacker-chosen password, successfully resetting the account's credentials without any server-side identity check. The attacker then authenticates to the WordPress admin dashboard with the new password, achieving full administrative control over the site.