CVE-2026-118803— Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result

Quick assessment

Affected

Bricks Bricks Theme

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bricks 主题 2.4.3 及更早版本存在一个无需身份验证的动态数据标签注入漏洞。该漏洞允许匿名攻击者控制 REST 端点中的对象，导致提交的值被重新解析为 Bricks 动态数据标签。攻击者可注入诸如、或等标签，从而在未进行身份验证的情况下泄露文章元数据及文章作者的用户记录（包括密码哈希值）。

CVSS 7.5 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1056.001 · Keylogging T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result

Source: CVE Program / CVE List V5

Vulnerability Description

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1336

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Bricks	Bricks Theme	0 ~ 2.4.4	-

II. Public POCs for CVE-2026-118803

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118803

请登录查看更多情报信息。

Other References for CVE-2026-118803 (2)

https://bricksbuilder.io/release/bricks-2-4-4/ release-notes
https://www.vulncheck.com/advisories/bricks-theme-unauthenticated-dynamic-data-tag-injection-via-query-result third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118803

IV. Related Vulnerabilities

Same vendor: Bricks

Same weakness: CWE-1336