{"id":"CVE-2026-118803","kind":"vulnerability","aliases":["CVE-2026-118803"],"related":[],"title":"Bricks Theme: unauthenticated REST injection leaks password hashes and user data","description":"Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.","summary":"Bricks Theme 2.4.3 and earlier lets anonymous visitors send a crafted urlParams value to the query_result REST endpoint, which the theme re-parses as a dynamic data tag. An attacker can use tags such as author_meta:user_pass to read post author data, including password hashes, without logging in.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bricks-theme","package","self-hosted","wordpress"],"not_affected_if":["bricks-newer-than-2.4.3","not-using-bricks"],"how_to_check":"- Check the installed Bricks version in the WordPress admin under Appearance, Themes, or with `wp theme get bricks --field=version`\n- Confirm whether the site exposes the Bricks query_result REST endpoint to anonymous requests (unknown from sources how to test this safely)","fix":"- Update Bricks Theme to a release newer than `2.4.3` (the exact fixed version is unknown from sources)\n- Until patched, restrict or disable anonymous access to the Bricks REST routes at the web server or with a plugin\n- Rotate passwords for WordPress users, especially authors, if the site ran a vulnerable version exposed to the internet","status":"open","published_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","triaged_at":"2026-10-28T22:36:50+00:00","updated_at":"2026-10-28T22:36:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T22:36:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update Bricks Theme to a release newer than `2.4.3` (the exact fixed version is unknown from sources)\n- Until patched, restrict or disable anonymous access to the Bricks REST routes at the web server or with a plugin\n- Rotate passwords for WordPress users, especially authors, if the site ran a vulnerable version exposed to the internet","reach":"internet","title":"Bricks Theme: unauthenticated REST injection leaks password hashes and user data","impact":"high","summary":"Bricks Theme 2.4.3 and earlier lets anonymous visitors send a crafted urlParams value to the query_result REST endpoint, which the theme re-parses as a dynamic data tag. An attacker can use tags such as author_meta:user_pass to read post author data, including password hashes, without logging in.","category":"package","nicknames":[],"who_cares":["wordpress","bricks-theme","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads password hashes and user emails without logging in","analyst_note":"Find the patched Bricks version and the fix commit from the NVD entry or the vendor changelog; confirm whether the query_result endpoint is reachable by default.","how_to_check":"- Check the installed Bricks version in the WordPress admin under Appearance, Themes, or with `wp theme get bricks --field=version`\n- Confirm whether the site exposes the Bricks query_result REST endpoint to anonymous requests (unknown from sources how to test this safely)","needs_analyst":true,"not_affected_if":["bricks-newer-than-2.4.3","not-using-bricks"],"who_is_affected":"Sites running the Bricks WordPress theme version 2.4.3 or earlier are exposed, since the flaw sits in a public REST endpoint that needs no login. Managed hosts or sites on a newer Bricks release are not affected by this entry. Sites that never installed Bricks can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":3386,"output_tokens":708,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118803':14A,17A '-2026':13A,16A '2.4.3':28B,79C 'allow':92C 'amount':138C 'anonym':32B,93C 'attack':57B,94C,121C 'authent':155C 'author':63B,70B,127C,131C,146C 'brick':1A,19B,26B,77C,117C 'bricks-them':18B 'caus':106C 'cf':136C 'contain':82C 'control':96C 'coupon':137C 'craft':36B 'cve':12A,15A 'data':11A,54B,71B,87C,119C 'dynam':53B,86C,118C 'dynamic-data':85C 'earlier':30B 'email':134C 'endpoint':44B,105C 'hash':8A,74B,153C 'host':24B 'includ':72B,150C 'inject':5A,89C,123C 'leak':6A,140C 'let':31B 'log':76B 'meta':64B,128C,132C,142C 'object':99C 'packag':21B 'pars':50B,114C 'pass':66B,130C 'password':7A,73B,152C 'post':69B,141C,145C 'queri':41B,102C 're':49B,113C 're-pars':48B,112C 'read':68B 'record':149C 'rest':4A,43B,104C 'result':42B,103C 'self':23B 'self-host':22B 'send':34B 'submit':108C 'tag':55B,60B,88C,120C,124C 'theme':2A,20B,27B,47B,78C 'unauthent':3A,84C 'urlparam':37B,98C 'use':59B 'user':10A,65B,129C,133C,148C 'valu':38B,109C 'visitor':33B 'vulner':90C 'without':75B,154C 'wordpress':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Bricks WordPress theme version 2.4.3 or earlier are exposed, since the flaw sits in a public REST endpoint that needs no login. Managed hosts or sites on a newer Bricks release are not affected by this entry. Sites that never installed Bricks can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118803","severity":null,"published_at":"2026-10-28T22:17:14+00:00","modified_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","fetched_at":"2026-10-28T22:35:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}