Executive brief
BricksForge is a WordPress plugin that provides form building functionality for the Bricks theme. The plugin fails to verify user identity when processing password reset requests through its Pro Forms feature, allowing anyone on the internet to reset passwords for any user account—including administrators—without authentication. An attacker can hijack admin accounts and gain full control of the affected website.
Technical details
The vulnerability is a broken access control (CWE-862) in the Pro Forms password reset action. The plugin's form submission endpoint (/wp-json/bricksforge/v1/form_submit) does not properly validate the requester's identity when the "Reset User Password" action is triggered in update mode. The server-side "Verify Current Password" option is disabled by default, making the vulnerable configuration the standard deployment. An unauthenticated attacker can obtain a WordPress nonce via the bricksforge_regenerate_nonce AJAX action, then craft a malicious POST request to reset any user's password by providing only their email address. The attack requires the vulnerable form to exist on the site and is fully exploitable over the network with no authentication or user interaction. Upon successful exploitation, the attacker receives WordPress session cookies and gains immediate access as the targeted user. A patch is available in version 3.1.8.8.
Affected products
- BricksForge BricksForge before 3.1.8.8
Timeline
- 2026-08-04: disclosed
- 2026-08-10: advisory
- 2026-08-10: patched: version 3.1.8.8