Privilege Escalation Vulnerability in Bricks Theme for WordPress

CVE-2024-2297

What is CVE-2024-2297?

The Bricks theme for WordPress contains a privilege escalation vulnerability due to inadequate validation checks in the create_autosave AJAX function. Authenticated attackers with contributor-level access can execute arbitrary PHP code as administrators. Successful exploitation necessitates specific conditions, including that the Bricks Builder is enabled for posts, builder access for contributors is granted, and 'Code Execution' is permitted in the theme's settings for administrators.

References