Bricks Builder CVE-2026-40723

Exploitation requires a valid WordPress subscriber-level (or higher) account on the target site - this is the lowest authenticated WordPress role and is obtained via site registration or credential compromise. The target site must be running Bricks Builder version 2.1.4 or earlier. Sites with open user registration (WordPress default setting 'Anyone can register' enabled) are most exposed because an attacker can self-create a subscriber account without prior access. What limits exploitation: authentication is required (PR:L per CVSS - unauthenticated exploitation is not indicated); impact is confined to integrity with no confirmed confidentiality or availability effect; and sites with closed registration or no subscriber accounts significantly reduce the realistic attack surface.

The NVD-assigned CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with no user interaction (UI:N), unchanged scope (S:U), and integrity-only impact (I:L). The PR:L metric is the critical limiting factor: exploitation is gated on possessing a valid WordPress subscriber account, which on sites with closed registration is a meaningful barrier. No EPSS score was provided in the source data, so exploitation probability cannot be quantified beyond the CVSS signals. The absence of a KEV listing and any reported POC suggests this is not currently being mass-exploited. Real-world priority is moderate: sites with open user registration face meaningful risk of unauthorized content manipulation, while sites with closed registration have substantially reduced exposure. Impact is bounded to integrity (I:L) with no confidentiality or availability concern confirmed in the available data.

An attacker registers a free subscriber account on a WordPress site running Bricks Builder <= 2.1.4 (or obtains credentials for an existing low-privilege account). The attacker then sends a crafted HTTP request directly to a Bricks Builder AJAX endpoint or REST route that normally requires editor or administrator privileges, bypassing the missing authorization check and modifying page content, templates, or builder settings. No public POC has been identified at time of analysis, but the attack requires only standard HTTP tooling given the network-accessible and low-complexity vector.