Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-17 | 3 | Disclosure1Patch2 |
| 2026-07-20 | 1 | Patch1 |
🚨 CVE-2026-14956 — CVSS 9.8/10 ██████████ The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/l380ue9Oce
Post summary
The post announces a critical privilege escalation vulnerability in Bricksforge WordPress plugin with a CVSS of 9.8/10 and urges users to apply the available patch.
WordPressプラグイン「Bricksforge (Pro Forms)」に管理者アカウントを未認証で作成できる権限昇格の脆弱性CVE-2026-14956（CVSS 9.8）が報告されています。ベンダーは3.1.8.7で修正済み。早めの対応をご検討ください。 https://cve.autoarticles.net/cve/CVE-2026-14956
Post summary
A privilege‑escalation flaw (CVE‑2026‑14956) in the Bricksforge (Pro Forms) WordPress plugin has been reported; the vendor has released version 3.1.8.7 to fix it.
WordPress sites using Bricksforge <=3.1.8.6 face privilege escalation (CVSS 9.8). Review and update affected plugins. https://nvd.nist.gov/vuln/detail/CVE-2026-14956 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/WKeCWAXfqT
Post summary
The tweet announces that WordPress sites running Bricksforge <=3.1.8.6 are vulnerable to a privilege escalation flaw with CVSS 9.8, and urges users to update the plugin.
🚨 CVE-2026-14956 | CVSS 9.8 Critical Bricksforge flaw lets unauthenticated attackers create administrator accounts. 🔹 Update to v3.1.8.6+ 🔹 Audit admin accounts 🔹 Restrict public registration forms 🔗 https://threataft.com/articles/bricksforge-unauthenticated-privilege-escalation-cve-2026-14956?utm_source=twitter&utm_medium=social&utm_campaign=share #WordPress #CyberSecurity #CVE #ThreatIntel
Post summary
The tweet announces CVE-2026-14956, a critical flaw that lets unauthenticated users create admin accounts, and urges users to upgrade Bricksforge to v3.1.8.6+ and audit admin accounts.