Critical Privilege Escalation Flaw Found in Bricksforge WordPress Plugin
A critical vulnerability in the Bricksforge WordPress plugin allows unauthenticated attackers to create unauthorized administrator accounts.
The Bricksforge plugin for WordPress, in all versions up to and including 3.1.8.6, is affected by a critical privilege escalation vulnerability tracked as CVE-2026-14956. The flaw stems from improper validation of the fieldIds parameter within the Pro Forms registration action, which permits the injection of attacker-supplied field IDs into the trusted form-field whitelist.
This vulnerability carries a CVSS score of 9.8 and poses a significant security risk. By submitting a crafted request to a publicly accessible Bricksforge Pro Forms element configured with the User Registration action, an unauthenticated attacker can register a new account with administrative privileges.
Site administrators using the Bricksforge plugin are advised to verify their Pro Forms configurations and monitor for updates to address this security deficiency.
Sources
- GitHub Security Advisories Original source
Continue Reading
SecurityNewA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.