Bricksforge Plugin Vulnerability Exposed

A critical security vulnerability has been identified within the Bricksforge plugin for WordPress, creating a pathway for unauthorized administrative access. Security researchers assigned the issue identifier CVE-2026-14956 to the flaw, which exists in all versions of the plugin up to and including 3.1.8.6.

Flaw in Registration Logic

The core of the issue resides within the Pro Forms registration action. Specifically, the plugin exhibits improper validation of the fieldIds parameter during the registration process. This technical oversight permits an attacker to supply their own field IDs, which are then inadvertently added to the trusted form-field whitelist.

By leveraging this gap, unauthenticated actors can manipulate the registration flow to create a new administrator account. The attack requires that the target WordPress site has a Bricksforge Pro Forms element configured with the User Registration action, which must be publicly accessible for the exploit to be successful.

Scope of the Security Risk

• Advisory ID: GHSA-3h83-c8w5-cccx
• CVE identifier: CVE-2026-14956
• Severity rating: Critical (CVSS 9.8)
• Affected versions: Up to and including 3.1.8.6

Implications for Site Security

Because the vulnerability allows for the creation of accounts with the highest level of system privileges, sites using affected versions of Bricksforge face a significant security risk if they host public-facing registration forms. The ability for an unauthenticated user to elevate their permissions to administrator status could lead to full site compromise if the plugin is not updated or secured according to the vendor's guidance.