CVE-2026-18030
Received Received - Intake

Unauthenticated Password Change in BricksForge WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-18030
EUVD
EUVD-2026-55038

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bricksforge bricksforge to 3.1.8.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BricksForge WordPress plugin before version 3.1.8.8 has a flaw where it does not check who is requesting a password change. This allows unauthenticated attackers to set new passwords for any user, including administrators, and take over their accounts.

Detection Guidance

Check if the BricksForge WordPress plugin version is below 3.1.8.8 by inspecting the plugin files or WordPress admin panel. Look for forms using the plugin's password reset action in update mode.

Impact Analysis

Attackers can gain full control of any user account on a vulnerable site, including admin accounts. This could lead to website defacement, data theft, or further compromise of the site and its users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Update the BricksForge plugin to version 3.1.8.8 or later immediately. Disable any forms using the vulnerable password reset action until updated. Review user accounts for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart