Live › vulnerability › CVE-2026-118803
Go to dashboardBricks Theme 2.4.3 and earlier lets anonymous visitors send a crafted urlParams value to the query_result REST endpoint, which the theme re-parses as a dynamic data tag. An attacker can use tags such as author_meta:user_pass to read post author data, including password hashes, without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Sites running the Bricks WordPress theme version 2.4.3 or earlier are exposed, since the flaw sits in a public REST endpoint that needs no login. Managed hosts or sites on a newer Bricks release are not affected by this entry. Sites that never installed Bricks can skip it.
No product ranges from the sources yet.
wp theme get bricks --field=version2.4.3 (the exact fixed version is unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-118803")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.