CVE-2024-31244 CRITICAL

CVE-2024-31244: WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

Vendor Bricksforge

Product Bricksforge

Weakness CWE-862 · Missing authorization

Published June 9, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.

Explanation of Vulnerability in Simple Terms

02Summary

Bricksforge versions up to 2.0.17 lack proper authorization checks, allowing unauthenticated attackers to perform administrative actions remotely. An attacker can read, modify, or delete site data without logging in. This affects all installations running the vulnerable version. Update immediately to a version newer than 2.0.17.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete site data without authentication.

Potential impact on your site

04Site Impact

Attackers can compromise your entire site without a password, including data theft, defacement, or deletion.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 9, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-31244 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities