Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.4.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Bricks theme for WordPress is affected. Unauthenticated visitors can abuse it to expose sensitive data, including post metadata and user account details such as email addresses and password hashes.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- Bricks Bricks Theme
fixed in 2.4.4