Vulnerability · Published Oct 28, 2022 · Assigned by Wordfence
CVE-2022-3401
High 8.8
In plain English
A high-severity security flaw in Bricks from Bricks Builder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Official description
The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability (CVE-2022-3400), makes it possible for authenticated attackers with minimal permissions, such as a subscriber, can edit any page, post, or template on the vulnerable WordPress website and inject a code execution block that can be used to achieve remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bricks Builder | Bricks | 1.2 – through 1.5.3 |