Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.
Summary
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | BricksForge | before 3.1.8.8 | 3.1.8.8 | Patch available | CNA |
- BricksForge VendorUnknown Affected before 3.1.8.8 Fixed in 3.1.8.8 Patch available CNA
Remediation
- Fix · CNA BricksForge (Unknown) Fixed in 3.1.8.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18030
- 2026-10-03 Alias added: GHSA-3w5j-v478-4p9q
References
Sources
- CVE-2026-18030 · CVE Program
- CVE-2026-18030 · NVD
- FIRST EPSS
- GHSA-3w5j-v478-4p9q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences