Bricks Theme: Unauthenticated dynamic data tag injection in query_result
Summary
Bricks Theme 2.4.3 and earlier contains an unauthenticated dynamic data tag injection vulnerability in the query_result REST endpoint. Anonymous attackers can control the urlParams value, which is then parsed as a Bricks dynamic data tag. An attacker can use tags such as author_meta:user_pass to leak post meta and the post author's user record, including the password hash, without logging in.
Affected
- Bricks Theme 2.4.3 and earlier (CNA range: below 2.4.4)
- Earliest affected version: Unknown.
Fixed in
- Bricks 2.4.4 (released 28 Oct 2026, includes fixes for CVE-2026-118803 and CVE-2026-118804)
Workaround
- No vendor workaround is published. Patching is the only fix the vendor documents.
- Third-party database VulDB suggests WAF rules that block dynamic data tag syntax in REST parameters. This is unverified and may be bypassable.
- If public access to the query_result endpoint is not needed, restrict it to trusted administrative IP addresses. Check first, because the front end may depend on it.
Exploitation
- No exploitation in the wild found as of 29 Oct 2026.
- No public proof-of-concept or exploit code found.
- EPSS: 0.37 % (not independently verified).
- Not listed in CISA KEV according to Strix; the KEV catalogue was not checked directly.
Our recommendation
- Identify all WordPress sites running Bricks and check their versions.
- Update to Bricks 2.4.4 or later, starting with internet-facing sites.
- If patching is delayed, restrict access to the query_result endpoint first.
- After patching, review administrator and author accounts and reset their passwords as a precaution.
- Monitor for public proof-of-concept code and a CISA KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Bricks 2.4.4 release notes (vendor) bricksbuilder.io
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-118803 vuldb.com
- Bricks 2.4.4 forum announcement (vendor) forum.bricksbuilder.io
- Bricks changelog (vendor) bricksbuilder.io
- CIRCL CWE-1336 entry vulnerability.circl.lu
- OffSeq Radar CVE-2026-118803 radar.offseq.com
- Strix CVE-2026-118803 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 11:35.
Original description (NVD)
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.