PT-2025-8915 · WordPress · Bricks

Emil Trägårdh + 1 · Published 2025-02-27 · Updated 2025-03-11 · CVE-2024-2297

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Bricks theme for WordPress versions up to, and including, 1.9.6.1

Description The issue is due to insufficient validation checks on the create autosave AJAX function, allowing authenticated attackers with contributor-level access and above to execute arbitrary PHP code with elevated privileges. Successful exploitation requires the Bricks Builder to be enabled for posts, Builder access to be enabled for contributor-level users, and "Code Execution" to be enabled for administrator-level users within the theme's settings.

Recommendations For versions up to, and including, 1.9.6.1, consider disabling the create autosave AJAX function until a patch is available. Additionally, restrict Builder access to contributor-level users and disable "Code Execution" for administrator-level users within the theme's settings to minimize the risk of exploitation.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-2297

Affected Products

Bricks

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-2297 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2297 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/cb075e85-75fc-4008-8270-4d1064ace29e?source=cve · Note
• https://t.me/cvenotify/114337 · Telegram Post
• https://bricksbuilder.io/release/bricks-1-9-7 · Note
• https://t.me/cvenotify/112593 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1895083459111973188 · Twitter Post
• https://t.me/cvedetector/19018 · Telegram Post
• https://twitter.com/vulns_space/status/1894998549957312871 · Twitter Post
• https://twitter.com/CVEnew/status/1895241225525174619 · Twitter Post