Quick answers
- Is CVE-2026-18030 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18030 being exploited in the wild.
- How severe is CVE-2026-18030?
- High severity, with a CVSS score of 8.1, published 10 August 2026.
- Which products and versions are affected?
- Bricksforge before 3.1.8.8.
- Is there a fix for CVE-2026-18030?
- A patch was published on 2026-08-10: version 3.1.8.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18030 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-18030?
- Check whether you run Bricksforge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control (CWE-862) in the Pro Forms password reset action. The plugin's form submission endpoint (/wp-json/bricksforge/v1/form_submit) does not properly validate the requester's identity when the "Reset User Password" action is triggered in update mode. The server-side "Verify Current Password" option is disabled by default, making the vulnerable configuration the standard deployment. An unauthenticated attacker can obtain a WordPress nonce via the bricksforge_regenerate_nonce AJAX action, then craft a malicious POST request to reset any user's password by providing only their email address. The attack requires the vulnerable form to exist on the site and is fully exploitable over the network with no authentication or user interaction. Upon successful exploitation, the attacker receives WordPress session cookies and gains immediate access as the targeted user. A patch is available in version 3.1.8.8.
Affected products
- BricksForge BricksForge before 3.1.8.8
Timeline
- 2026-08-04: disclosed
- 2026-08-10: advisory
- 2026-08-10: patched: version 3.1.8.8