CVE-2026-118803

Received Received - Intake

Unauthenticated Dynamic Data Tag Injection in Bricks Theme

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-28

Last Modified

2026-10-28

Generated

2026-10-29

AI Q&A

2026-10-29

EPSS Evaluated

N/A

NVD

CVE-2026-118803

EUVD

EUVD-2026-112502

Affected Vendors & Products

Vendor	Product	Version / Range
Bricks	Bricks Theme	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This vulnerability in Bricks Theme 2.4.3 and earlier allows unauthenticated attackers to inject malicious dynamic-data tags into the urlParams object via the query_result REST endpoint. This can cause the system to re-parse the injected value as a Bricks dynamic data tag, enabling attackers to extract sensitive data like user passwords or email addresses without needing authentication.

Detection Guidance

Check for unauthorized access to the Bricks Theme query_result REST endpoint. Look for suspicious dynamic data tag injections in logs, such as author_meta:user_pass or cf_coupon_amount. Inspect network traffic for requests to /wp-json/bricks/v1/query_result with unusual parameters.

Impact Analysis

Attackers could exploit this to leak sensitive information such as post meta, user records, and password hashes from the WordPress site. This could lead to unauthorized access, data breaches, or further attacks on users or the system if credentials are compromised.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR's data protection principles and potentially HIPAA's safeguards for protected health information. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Update the Bricks Theme to the latest version (2.4.3 or newer). If an update is unavailable, disable the Bricks Theme temporarily. Restrict access to the query_result endpoint via server rules or plugins. Monitor logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-118803. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70