CVE-2023-3408: Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings
The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'savesettings' function. This makes it possible for unauthenticated attackers to modify the theme's settings, including enabling a setting which allows lower-privileged users such as contributors to perform code execution, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3408?
CVE-2023-3408 is considered a high severity vulnerability due to its potential for unauthenticated modification of theme settings.
How do I fix CVE-2023-3408?
To fix CVE-2023-3408, update the Bricks theme to version 1.8.2 or later.
What is the risk associated with CVE-2023-3408?
The risk associated with CVE-2023-3408 is that attackers can exploit the vulnerability to change site settings without proper authentication.
Which versions are affected by CVE-2023-3408?
CVE-2023-3408 affects all versions of the Bricks theme up to and including 1.8.1.
What type of vulnerability is CVE-2023-3408?
CVE-2023-3408 is a Cross-Site Request Forgery (CSRF) vulnerability.