Executive brief
Bricks Builder is a popular visual website design tool for WordPress. A security flaw in versions 2.1.4 and earlier allows users with basic 'Subscriber' accounts to perform actions they should not be authorized to do. While the impact is considered low, it could allow unauthorized modifications to certain site settings or content.
Technical details
A broken access control vulnerability (CWE-862: Missing Authorization) exists in the Bricks Builder theme for WordPress in versions up to and including 2.1.4. The flaw allows an authenticated attacker with low-level 'Subscriber' privileges to execute functions or actions that should be restricted to higher-privileged users. This is typically caused by a lack of server-side capability checks or missing nonce validation on specific administrative endpoints. An attacker can exploit this over the network to modify site data, though the CVSS score suggests no impact on data confidentiality or service availability. The issue is resolved in version 2.2.
Affected products
- Bricks Bricks Builder <= 2.1.4
Timeline
- 2025-12-17: other: Reported by researcher Phat RiO
- 2026-02-24: advisory: Patchstack advisory published
- 2026-06-17: disclosed: CVE published to NVD
- 2026-02-24: patched: Version 2.2 released to address the issue