Privilege Escalation in Bricksforge Plugin for WordPress

CVE-2026-14956

What is CVE-2026-14956?

The Bricksforge plugin for WordPress is susceptible to a privilege escalation flaw stemming from improper validation of the fieldIds parameter in the Pro Forms registration action. This vulnerability allows an attacker to manipulate field IDs to be included in the trusted form-field whitelist. Consequently, unauthenticated attackers can create a new administrator account by submitting a specially crafted request to a publicly accessible Bricksforge Pro Forms registration form. The exploitation is dependent on the presence of a public Bricksforge Pro Forms element configured with the User Registration action.

References