Bricksforge
Monthly
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.
Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.
Unauthenticated privilege escalation in the Bricksforge WordPress plugin (versions ≤ 3.1.8.6) lets remote attackers create a new administrator account by abusing the Pro Forms User Registration action. The plugin fails to validate the fieldIds parameter, so attacker-supplied field IDs are injected into the trusted form-field whitelist, enabling mass-assignment of a privileged role. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable (CVSS 9.8) on any site exposing a Pro Forms registration element.
Unauthenticated sensitive data exposure in the Bricksforge WordPress plugin versions 3.1.8.4 and earlier allows remote attackers to retrieve confidential information without any credentials. The flaw, tracked under CWE-201 (Insertion of Sensitive Information Into Sent Data), carries a CVSS 3.1 score of 7.5 driven entirely by confidentiality impact, and no public exploit has been identified at time of analysis.
Missing Authorization vulnerability in Bricksforge.0.17. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Bricksforge.0.17. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.
Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.
Unauthenticated privilege escalation in the Bricksforge WordPress plugin (versions ≤ 3.1.8.6) lets remote attackers create a new administrator account by abusing the Pro Forms User Registration action. The plugin fails to validate the fieldIds parameter, so attacker-supplied field IDs are injected into the trusted form-field whitelist, enabling mass-assignment of a privileged role. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable (CVSS 9.8) on any site exposing a Pro Forms registration element.
Unauthenticated sensitive data exposure in the Bricksforge WordPress plugin versions 3.1.8.4 and earlier allows remote attackers to retrieve confidential information without any credentials. The flaw, tracked under CWE-201 (Insertion of Sensitive Information Into Sent Data), carries a CVSS 3.1 score of 7.5 driven entirely by confidentiality impact, and no public exploit has been identified at time of analysis.
Missing Authorization vulnerability in Bricksforge.0.17. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Bricksforge.0.17. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.