EUVD-2026-37592Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or acquire subscriber WordPress account
-
DeliveryAuthenticate to target WordPress site
-
ExploitCraft HTTP request targeting restricted Bricks Builder endpoint
-
ExecutionBypass missing authorization check (CWE-862)
-
ImpactPerform unauthorized content modification
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress subscriber-level (or higher) account on the target site - this is the lowest authenticated WordPress role and is obtained via site registration or credential compromise. The target site must be running Bricks Builder version 2.1.4 or earlier. Sites with open user registration (WordPress default setting 'Anyone can register' enabled) are most exposed because an attacker can self-create a subscriber account without prior access. What limits exploitation: authentication is required (PR:L per CVSS - unauthenticated exploitation is not indicated); impact is confined to integrity with no confirmed confidentiality or availability effect; and sites with closed registration or no subscriber accounts significantly reduce the realistic attack surface. |
| Impact | The NVD-assigned CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with no user interaction (UI:N), unchanged scope (S:U), and integrity-only impact (I:L). The PR:L metric is the critical limiting factor: exploitation is gated on possessing a valid WordPress subscriber account, which on sites with closed registration is a meaningful barrier. No EPSS score was provided in the source data, so exploitation probability cannot be quantified beyond the CVSS signals. The absence of a KEV listing and any reported POC suggests this is not currently being mass-exploited. Real-world priority is moderate: sites with open user registration face meaningful risk of unauthorized content manipulation, while sites with closed registration have substantially reduced exposure. Impact is bounded to integrity (I:L) with no confidentiality or availability concern confirmed in the available data. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a WordPress site running Bricks Builder <= 2.1.4 (or obtains credentials for an existing low-privilege account). The attacker then sends a crafted HTTP request directly to a Bricks Builder AJAX endpoint or REST route that normally requires editor or administrator privileges, bypassing the missing authorization check and modifying page content, templates, or builder settings. No public POC has been identified at time of analysis, but the attack requires only standard HTTP tooling given the network-accessible and low-complexity vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Broken Access Control in Bricks Builder for WordPress (versions up to and including 2.1.4) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privilege roles such as editor or administrator. Rooted in CWE-862 (Missing Authorization), the flaw means certain builder endpoints or AJAX actions execute without verifying whether the requesting user holds sufficient capabilities. No public exploit code identified at time of analysis, and this CVE is not listed in CISA KEV; however, the low authentication barrier (any registered subscriber) on sites with open registration increases realistic exposure.
RemediationAI
Update Bricks Builder to a version beyond 2.1.4 as the primary remediation; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/bricks/vulnerability/wordpress-bricks-builder-theme-2-1-4-broken-access-control-vulnerability?_s_id=cve and the vendor changelog for the confirmed patched release version, which is not independently specified in the available data. If immediate patching is not possible, disable public user registration (Settings > General > uncheck 'Anyone can register') to eliminate the subscriber account attack surface entirely - note this prevents new users from self-registering for any purpose. As an additional compensating control, audit and remove any unnecessary subscriber-level accounts. The trade-off of disabling registration is loss of self-service onboarding workflows if the site relies on them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bricks Builder is a visual WordPress theme and page-builder product identified by CPE cpe:2.3:a:bricks:bricks_builder:*:*:*:*:*:*:*:*. WordPress enforces a role-capability model where subscribers hold the minimum set of permissions (essentially read-only). CWE-862 (Missing Authorization) describes the root cause: the application performs a privileged operation - such as modifying builder templates, page structure, or builder-specific settings - without first calling an appropriate WordPress capability check (e.g., current_user_can()). Because the authorization gate is absent rather than misconfigured, a subscriber can reach restricted REST API routes or AJAX handlers and alter site content in ways reserved for higher roles.
Know when Bricks gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber authentication required (PR:L); network reachable with no complexity; impact limited to unauthorized write actions with no confidentiality or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include
Unauthenticated attackers can leak password hashes, email addresses, and post metadata from WordPress sites running Bric
Broken access control in the Bricks Builder WordPress plugin/theme through version 2.4.3 lets unauthenticated remote att
Unauthenticated content disclosure in Bricks Theme 2.4 and earlier for WordPress lets anonymous attackers read draft and
The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. Rate
Reflected cross-site scripting in Bricks Builder WordPress theme through version 1.9.2 to 2.2 enables remote attackers t
The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_sav
The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inc
GitHub PoC
Exploit-DB