What the vulnerability does
01Description
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.
Explanation of Vulnerability in Simple Terms
02Summary
Bricksforge versions up to 3.1.8.6 contain a privilege management flaw that allows unauthenticated attackers to gain full control over the application. An attacker can read sensitive data, modify site content, and disrupt service without needing valid credentials or user interaction. This affects all installations running the vulnerable version range.
What an attacker can do
03Attacker Capabilities
Read all data, modify any content, and disable the site without authentication.
Potential impact on your site
04Site Impact
Complete compromise of the Bricksforge installation and any data it manages.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 17, 2026
CVE published
July 21, 2026
Record updated
