PT-2022-21959 · WordPress · Bricks

Published 2022-10-28 · Updated 2022-10-28 · CVE-2022-3400

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions The Bricks theme for WordPress versions 1.0 through 1.5.3

Description The issue is related to authorization bypass due to a missing capability check on the bricks save post AJAX action. This allows authenticated attackers with minimal permissions to edit any page, post, or template on the vulnerable WordPress website.

Recommendations For versions 1.0 through 1.5.3, consider disabling the bricks save post AJAX action until a patch is available to prevent exploitation. Restrict access to editing pages, posts, or templates to minimize the risk of unauthorized modifications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-3400

Affected Products

Bricks

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-3400 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3400 · Vendor Advisory
• https://t.me/cibsecurity/52231 · Telegram Post
• https://wordfence.com/vulnerability-advisories-continued/#CVE-2022-3400 · Note
• https://t.me/cibsecurity/52252 · Telegram Post
• https://bricksbuilder.io · Note