7.5
HighCVSS 3.1 · from VulnCheck
CVE-2026-118803
Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
Bricks Theme · CWE-1336 · CWE-1336AffectedBricks Theme
FixUpdate to 2.4.4 or newer
PublishedOct 28, 21:11 · VulnCheck
ScoredOct 28 · 7.5 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read data. CVSS impact.
Description
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inBricks Themebefore 2.4.42.4.4
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known