CVE-2022-3400 MEDIUM

CVE-2022-3400

Vendor Bricks Builder
Product Bricks
Published October 28, 2022
Last update January 31, 2025

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/A:N/I:H/C:N/S:U/UI:N/PR:L/AC:L/AV:N

What the vulnerability does

01Description

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template on the vulnerable WordPress website.

Key dates

02Disclosure timeline

October 28, 2022 CVE published
January 31, 2025 Record updated