CVE-2022-3401 - The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3

Back Back to CVE browser

HIGH

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3

Published Oct 28, 2022

8.8

HIGH

CVSS 3.1

EPSS 1.70%

Description

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability (CVE-2022-3400), makes it possible for authenticated attackers with minimal permissions, such as a subscriber, can edit any page, post, or template on the vulnerable WordPress website and inject a code execution block that can be used to achieve remote code execution.

Affected products

Vendor Bricks Builder Product Bricks Default
unaffected
- Version
  1.2
  Status
  affected
  Constraints
  <=1.5.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bricks Builder

Bricks

unaffected

Version	Status	Constraints
1.2	affected	<=1.5.3

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://bricksbuilder.io/
ProductVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42778
Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3401
Third Party Advisory

Link	Providers	Tags
https://bricksbuilder.io/		ProductVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42778		Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3401		Third Party Advisory