Bricks
Monthly
Unauthenticated content disclosure in Bricks Theme 2.4 and earlier for WordPress lets anonymous attackers read draft and unpublished page content through the load_popup_content REST endpoint. Any remote attacker can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId parameter on /wp-json/bricks/v1/load_popup_content to enumerate confidential drafts across the site, because the endpoint applies no post-status or capability check. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) confines impact to confidentiality - there is no write access, authentication bypass into administrative functions, or code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the decision label places remediation in the current week rather than as an emergency.
Broken access control in the Bricks Builder WordPress plugin/theme through version 2.4.3 lets unauthenticated remote attackers read content that WordPress would otherwise withhold, including draft and private posts and WooCommerce coupon records, through the plugin's /wp-json/bricks/v1/query_result REST endpoint. An attacker submits crafted post_status and post_type values inside the originalQueryVars parameter; the required nonce is described as publicly obtainable, so it does not act as a real barrier, and no authentication or user interaction is needed. Scored 7.5 with confidentiality-only impact (CWE-862) and flagged as a this-week priority; no public exploit identified at time of analysis.
Unauthenticated attackers can leak password hashes, email addresses, and post metadata from WordPress sites running Bricks Theme 2.4.3 and earlier by injecting dynamic-data tags through the query_result REST endpoint. The flaw is remotely exploitable with no authentication or user interaction (CVSS 7.5, confidentiality-only impact), and the vendor has released Bricks 2.4.4 as the fix. No CISA KEV entry is present and no public exploit was identified at time of analysis, but the unauthenticated confidentiality impact makes this a high-priority update.
Reflected cross-site scripting in Bricks Builder WordPress theme through version 1.9.2 to 2.2 enables remote attackers to execute malicious JavaScript in victim browsers by crafting URLs with unsanitized input that gets reflected into generated web pages without proper encoding. Exploitation requires victim interaction (clicking a malicious link) but no authentication, making phishing and social engineering viable delivery methods. EPSS and KEV data not available; no public exploit confirmed at time of analysis, though Patchstack disclosure suggests security researchers have demonstrated the vulnerability.
Broken Access Control in Bricks Builder for WordPress (versions up to and including 2.1.4) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privilege roles such as editor or administrator. Rooted in CWE-862 (Missing Authorization), the flaw means certain builder endpoints or AJAX actions execute without verifying whether the requesting user holds sufficient capabilities. No public exploit code identified at time of analysis, and this CVE is not listed in CISA KEV; however, the low authentication barrier (any registered subscriber) on sites with open registration increases realistic exposure.
The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated content disclosure in Bricks Theme 2.4 and earlier for WordPress lets anonymous attackers read draft and unpublished page content through the load_popup_content REST endpoint. Any remote attacker can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId parameter on /wp-json/bricks/v1/load_popup_content to enumerate confidential drafts across the site, because the endpoint applies no post-status or capability check. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) confines impact to confidentiality - there is no write access, authentication bypass into administrative functions, or code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the decision label places remediation in the current week rather than as an emergency.
Broken access control in the Bricks Builder WordPress plugin/theme through version 2.4.3 lets unauthenticated remote attackers read content that WordPress would otherwise withhold, including draft and private posts and WooCommerce coupon records, through the plugin's /wp-json/bricks/v1/query_result REST endpoint. An attacker submits crafted post_status and post_type values inside the originalQueryVars parameter; the required nonce is described as publicly obtainable, so it does not act as a real barrier, and no authentication or user interaction is needed. Scored 7.5 with confidentiality-only impact (CWE-862) and flagged as a this-week priority; no public exploit identified at time of analysis.
Unauthenticated attackers can leak password hashes, email addresses, and post metadata from WordPress sites running Bricks Theme 2.4.3 and earlier by injecting dynamic-data tags through the query_result REST endpoint. The flaw is remotely exploitable with no authentication or user interaction (CVSS 7.5, confidentiality-only impact), and the vendor has released Bricks 2.4.4 as the fix. No CISA KEV entry is present and no public exploit was identified at time of analysis, but the unauthenticated confidentiality impact makes this a high-priority update.
Reflected cross-site scripting in Bricks Builder WordPress theme through version 1.9.2 to 2.2 enables remote attackers to execute malicious JavaScript in victim browsers by crafting URLs with unsanitized input that gets reflected into generated web pages without proper encoding. Exploitation requires victim interaction (clicking a malicious link) but no authentication, making phishing and social engineering viable delivery methods. EPSS and KEV data not available; no public exploit confirmed at time of analysis, though Patchstack disclosure suggests security researchers have demonstrated the vulnerability.
Broken Access Control in Bricks Builder for WordPress (versions up to and including 2.1.4) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privilege roles such as editor or administrator. Rooted in CWE-862 (Missing Authorization), the flaw means certain builder endpoints or AJAX actions execute without verifying whether the requesting user holds sufficient capabilities. No public exploit code identified at time of analysis, and this CVE is not listed in CISA KEV; however, the low authentication barrier (any registered subscriber) on sites with open registration increases realistic exposure.
The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.