CVE-2023-3409: Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings
The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'resetsettings' function. This makes it possible for unauthenticated attackers to reset the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3409?
CVE-2023-3409 is classified as a medium severity Cross-Site Request Forgery vulnerability.
How does CVE-2023-3409 affect the Bricks theme for WordPress?
CVE-2023-3409 allows unauthenticated attackers to reset the theme's settings due to missing nonce validation.
Which versions of the Bricks theme are affected by CVE-2023-3409?
CVE-2023-3409 affects all versions of the Bricks theme up to and including 1.8.1.
How do I fix CVE-2023-3409?
To fix CVE-2023-3409, update the Bricks theme to version 1.8.2 or later.
What should I do if I can't update to fix CVE-2023-3409?
If you cannot update, consider disabling the affected features or implementing nonce validation manually until you can apply the update.