Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
critical
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This make...
- CVSS:
- 9.8
- Affected:
- up to 3.1.8.6
- Fixed in:
- 3.1.8.7
- Disclosed:
- Jul 16, 2026
CVE-2026-14956 on NVD →
Bricksforge <= 3.1.8.4 - Unauthenticated Information Exposure
medium
The Bricksforge plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.8.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
- CVSS:
- 5.3
- Affected:
- up to 3.1.8.4
- Fixed in:
- 3.1.8.5
- Disclosed:
- Apr 6, 2026
CVE-2026-34888 on NVD →
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated Arbitrary Email Sending
medium
The Bricksforge plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the a function in versions up to, and including, 2.0.17. This makes it possible for unauthenticated attackers to send arbitrary emails.
- CVSS:
- 5.3
- Affected:
- up to 2.0.17
- Fixed in:
- 2.1.1
- Disclosed:
- Apr 5, 2024
CVE-2024-31242 on NVD →
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Update
medium
The Bricksforge plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.17. This makes it possible for unauthenticated attackers to update arbitrary WordPress settings.
- CVSS:
- 5.3
- Affected:
- up to 2.0.17
- Fixed in:
- 2.1.1
- Disclosed:
- Apr 5, 2024
CVE-2024-31244 on NVD →
Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion
medium
The Bricksforge plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.17. This makes it possible for unauthenticated attackers to delete arbitrary WordPress settings.
- CVSS:
- 5.3
- Affected:
- up to 2.0.17
- Fixed in:
- 2.1.1
- Disclosed:
- Apr 5, 2024
CVE-2024-31243 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database