Bricksforge Pro Forms permits unauthenticated arbitrary password reset
Bricksforge before 3.1.8.8 fails to verify the requester's identity when a Pro Forms form uses the password-reset action in update mode. Server-side current-password verification is disabled by default for that action, so an unauthenticated attacker can set an arbitrary password for any user, including an Administrator, and take over the account.
- Component
- BricksForge
- Plugin slug
bricksforge- Affected
- < 3.1.8.8
- Safe version
3.1.8.8- Published
- Aug 10, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 10, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update to 3.1.8.8 or later immediately. Until updated, remove affected password-reset form actions or deactivate the plugin. Review password changes and privileged accounts, invalidate sessions and rotate credentials if exploitation is suspected.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H