Privilege Escalation Vulnerability in Bricks Theme for WordPress
CVE-2024-2297

7.1HIGH

Key Information:

Vendor
Bricks Builder
Status
Bricks
Vendor
CVE Published:
27 February 2025

Summary

The Bricks theme for WordPress contains a privilege escalation vulnerability due to inadequate validation checks in the create_autosave AJAX function. Authenticated attackers with contributor-level access can execute arbitrary PHP code as administrators. Successful exploitation necessitates specific conditions, including that the Bricks Builder is enabled for posts, builder access for contributors is granted, and 'Code Execution' is permitted in the theme's settings for administrators.

Affected Version(s)

Bricks * <= 1.9.6.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://bricksbuilder.io/release/bricks-1-9-7/

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emil Trägårdh
.