Bricks Theme
Monthly
Unauthenticated attackers can leak password hashes, email addresses, and post metadata from WordPress sites running Bricks Theme 2.4.3 and earlier by injecting dynamic-data tags through the query_result REST endpoint. The flaw is remotely exploitable with no authentication or user interaction (CVSS 7.5, confidentiality-only impact), and the vendor has released Bricks 2.4.4 as the fix. No CISA KEV entry is present and no public exploit was identified at time of analysis, but the unauthenticated confidentiality impact makes this a high-priority update.
Unauthenticated attackers can leak password hashes, email addresses, and post metadata from WordPress sites running Bricks Theme 2.4.3 and earlier by injecting dynamic-data tags through the query_result REST endpoint. The flaw is remotely exploitable with no authentication or user interaction (CVSS 7.5, confidentiality-only impact), and the vendor has released Bricks 2.4.4 as the fix. No CISA KEV entry is present and no public exploit was identified at time of analysis, but the unauthenticated confidentiality impact makes this a high-priority update.