CVE-2024-25600PoC

HIGHCVSS 10.0 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.

Back to dashboard

7.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
7 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 3d ago at 2 mentions (2026-08-24); latest day: 2
7 total mentions across 5 days

Deep dive

Activity timeline7 mentions / 5d

Signal classification4 categories

PoC

240.0%

Active Exploitation

120.0%

Disclosure

120.0%

General

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	1	Active Exploitation1
2026-08-24	2	Disclosure1PoC1
2026-10-02	1	General1
2026-10-20	1	PoC1

Full discourse7 posts

ExploitGrid@exploitgrid1d
ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2021-44228 (CVSS: 10) Apache Softw... CVE-2024-25600 (CVSS: 10) CVE-2025-32440 (CVSS: 10) jokob-sk CVE-2026-102255 (CVSS: 10) sonicwall CVE-2026-102785 (CVSS: 10) https://yootheme.com ..🧵👇
20020131
435 followersView on X
ExploitGrid@exploitgrid64d
Disclosure
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2023-22527 CVE-2023-22518 CVE-2023-46604 CVE-2024-25600 CVE-2023-41892 ..🧵👇
Post summary
The tweet serves as a daily digest announcing several newly disclosed critical CVEs, without providing further detail, PoC, exploit code, or patch information.
1102042
38 followersView on X
ExploitGrid@exploitgrid1d
💀CRITICAL Exploits Trending (all CVSS 10) ├CVE-2026-102785 · YOOtheme (Joomla) · 2nd exploit listing in 3 days ├CVE-2026-102255 · SonicWall SMA1000 ·Check tool live ├CVE-2025-32440 · NetAlertX · Auth bypass PoC live ├CVE-2024-25600 · Bricks Builder challenge environment live
0001079
435 followersView on X
ExploitGrid@exploitgrid7d
PoC
💀 CRITICAL Exploits Trending ├ CVE-2024-25600 · PoC live (10) ├ CVE-2026-103849 · Adobe · Lab environment live (10) ├ CVE-2026-61732 · BitterSecurity · ChatML role-token probe live (10) ├ CVE-2025-49113 · Roundcube · CTF environment live (9.9)
Post summary
The text is a trending exploits list highlighting four CVEs with PoC/live environment availability noted, but it lacks technical details, named exploit tools, or explicit active exploitation claims. The primary takeaway is the availability of Proof of Concepts.
1000048
408 followersView on X
ExploitGrid@exploitgrid64d
PoC
[EXPLOIT] EGE-CX-vlkY2aW [CRITICAL/PoC] Linked: CVE-2024-25600 WordPress Bricks Builder Theme 1.9.6 Remote Code Execution 🔗 https://exploitgrid.net/exploits/e6283beb-38bb-497a-b6e7-2230635c6484
Post summary
The post announces a critical PoC for CVE-2024-25600 against WordPress Bricks Builder Theme 1.9.6, including a link to exploit code but no evidence of active exploitation or patch.
1000039
38 followersView on X
Batho Okoro@BathoOkoro25d
General
Just rooted TryHack3M: Bricks Heist 🧱 CVE-2024-25600 RCE → hidden flag → rogue ubuntu.service #TryHackMe #BricksHeist #DFIR #Crypto I just earned the 3 Million Legend on TryHackMe! https://tryhackme.com/bathokoro22/badges/3-million-legend
Post summary
The text describes completing a TryHackMe CTF challenge involving CVE-2024-25600, mentioning RCE in a controlled environment. No PoC, exploit tools, active exploitation, or patches are referenced.
0000026
26 followersView on X
CoreSec Group@CoreSec_Group91d
Active Exploitation
Rooted TryHack3M: Bricks Heist 🧱🔓 WordPress Bricks theme RCE (CVE-2024-25600) → shell → hunted a disguised cryptominer hiding behind a fake systemd service → decoded an obfuscated wallet → traced it to LockBit Forensics > exploitation on this one. #TryHackMe #CTF #InfoSec https://t.co/qNF6Ypfwg9
Post summary
The tweet recounts exploiting CVE‑2024‑25600 to spawn a shell, drop a disguised cryptominer, and trace that malware to LockBit, indicating real‑world exploitation with no patched or mitigated state mentioned.
00000127
114 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2024-25600

ExploitGrid@exploitgridDisclosure

The tweet serves as a daily digest announcing several newly disclosed critical CVEs, without providing further detail, PoC, exploit code, or patch information.

ExploitGrid@exploitgridPoC

The text is a trending exploits list highlighting four CVEs with PoC/live environment availability noted, but it lacks technical details, named exploit tools, or explicit active exploitation claims. The primary takeaway is the availability of Proof of Concepts.

ExploitGrid@exploitgridPoC

The post announces a critical PoC for CVE-2024-25600 against WordPress Bricks Builder Theme 1.9.6, including a link to exploit code but no evidence of active exploitation or patch.

Batho Okoro@BathoOkoroGeneral

The text describes completing a TryHackMe CTF challenge involving CVE-2024-25600, mentioning RCE in a controlled environment. No PoC, exploit tools, active exploitation, or patches are referenced.

CoreSec Group@CoreSec_GroupActive Exploitation

The tweet recounts exploiting CVE‑2024‑25600 to spawn a shell, drop a disguised cryptominer, and trace that malware to LockBit, indicating real‑world exploitation with no patched or mitigated state mentioned.