What is the CVSS score of CVE-2026-18030?

CVE-2026-18030 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of BricksForge are affected by CVE-2026-18030?

A critical authentication flaw in BricksForge WordPress plugin (versions before 3.1.8.8) enables remote takeover of administrator accounts without prior credentials, putting all protected assets…. A patch is available.

Is there a public PoC exploit available for CVE-2026-18030?

Yes, a public proof-of-concept exploit is available for CVE-2026-18030. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-18030?

Within 24 hours, identify all WordPress instances running BricksForge versions prior to 3.1.8.8 and classify them as critical risk; if production or customer-facing, immediately restrict public access to the WordPress administrative interface as a temporary containment measure. Within 7 days, deploy BricksForge version 3.1.8.8 or later across all affected sites using your standard patch deployment procedures and verify successful deployment via plugin version checks. Within 30 days, review authentication logs from the pre-patch window for unauthorized password-change activity, conduct mandatory credential resets for all administrative accounts, and document remediation completion and patch compliance status in your vulnerability management system.

BricksForge CVE-2026-18030

EUVD-2026-55038 HIGH

Missing Authorization (CWE-862)

2026-08-10 WPScan

GHSA-3w5j-v478-4p9q

WordPress Authentication Bypass Bricksforge Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network delivery, no privileges or interaction needed; AC:H because the vulnerable password-update form action must be actively deployed on the site.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:31 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

8.1 (HIGH)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.

Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.

AnalysisAI

Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.

Technical ContextAI

BricksForge is a WordPress companion plugin for the Bricks page-builder that extends form-handling capabilities, including a password update/reset form action. The root cause is CWE-862 (Missing Authorization): when a user submits a password change through a BricksForge form configured in update mode, the plugin processes the request without verifying that the submitter is the legitimate account owner or possesses any credentials. The server-side current-password verification option exists as an optional setting for this form action but is disabled by default, meaning sites deploying the feature are exposed immediately without any deliberate misconfiguration. All versions of BricksForge from 0 up to but not including 3.1.8.8 are affected per CPE cpe:2.3:a:unknown:bricksforge:*:*:*:*:*:*:*:* (the NVD vendor field is listed as 'unknown', indicating the CPE record may not yet be fully attributed). The vulnerability was reported by WPScan and is tracked as EUVD-2026-55038.

RemediationAI

The primary fix is to update BricksForge to version 3.1.8.8 or later, which introduces proper server-side identity verification for password change form actions; this patch is vendor-released and confirmed by EUVD-2026-55038. Full details are in the WPScan advisory at https://wpscan.com/vulnerability/15463bda-fb39-4629-b96b-34b83191bab7/. If immediate patching cannot be completed, the most effective compensating control is to temporarily remove or unpublish any WordPress forms that use BricksForge's password update/reset action - this fully eliminates the attack surface at the cost of disabling self-service password change functionality for site users. As a secondary compensating measure, enabling the server-side current-password verification option within the BricksForge form action configuration (if accessible in the unpatched version) may reduce risk, though its efficacy in vulnerable releases has not been independently confirmed and should not be relied upon as a sole control. Web application firewall rules (e.g., via Wordfence or WP Cerber) can be configured to block unauthenticated POST requests targeting BricksForge form endpoints as an additional layer, but this approach requires correct endpoint identification and may affect legitimate form submissions.