Bricksforge WordPress Plugin Unauthenticated Privilege Escalation via Pro Forms Registration

Technical Analysis

CVE-2026-14956 (CVSS 9.8) stems from insufficient server-side validation of the fieldIds parameter passed to the Pro Forms User Registration action in Bricksforge. Attackers can inject field IDs that are not part of the intended whitelist, tricking the plugin into accepting attacker-controlled values for privileged fields such as user role during account creation. This allows unauthenticated actors to submit a crafted HTTP request to any public-facing Bricksforge Pro Forms registration form and create a new WordPress administrator account, granting full control over the site including plugin/theme editing and arbitrary PHP execution via the theme editor. Exploitation requires no authentication and no user interaction, only that the site has a publicly accessible form configured with the User Registration action, making this trivially automatable at scale. Organizations running AI agents or RAG pipelines that use WordPress as a content source, headless CMS backend, or knowledge base ingestion point should treat compromised admin access as a path to content poisoning, webshell deployment, or credential harvesting that could taint agent-consumed data or expose API keys stored in WordPress configuration.

Affected Systems

WordPress sites running the Bricksforge plugin versions up to and including 3.1.8.6, specifically those with a publicly accessible Bricksforge Pro Forms element configured with the User Registration action.

Indicators of Compromise

• No specific IOCs published at time of disclosure; monitor for anomalous POST requests to Pro Forms registration endpoints containing unexpected fieldIds parameters, and unrecognized new administrator accounts in WordPress user tables.

Remediation Steps

1. 1

   Update Bricksforge plugin

   Upgrade to the patched version of Bricksforge beyond 3.1.8.6 as soon as it is released by the vendor.

2. 2

   Audit administrator accounts

   Review the WordPress admin user list for unauthorized or unrecognized accounts created via the Pro Forms registration action and remove them immediately.

3. 3

   Disable or restrict Pro Forms registration

   Temporarily disable the User Registration action on public Pro Forms elements or restrict form access until the patch is applied.

4. 4

   Implement WAF rules

   Deploy web application firewall rules to detect and block anomalous fieldIds parameter values in Pro Forms registration submissions.

5. 5

   Rotate credentials and API keys

   If compromise is suspected, rotate all WordPress admin credentials, API keys, and any secrets exposed through the compromised site, especially those used by connected agent or automation systems.