CVE-2025-6495: Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter
The Bricks theme for WordPress is vulnerable to blind SQL Injection via the ‘p’ parameter in all versions up to, and including, 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6495?
CVE-2025-6495 is classified as a critical vulnerability due to its potential for exploitation through blind SQL Injection.
How do I fix CVE-2025-6495?
To fix CVE-2025-6495, you should upgrade the Bricks theme to version 1.12.5 or later, which includes the necessary security patches.
What versions of the Bricks theme are affected by CVE-2025-6495?
CVE-2025-6495 affects all versions of the Bricks theme up to and including 1.12.4.
What impact does CVE-2025-6495 have on affected systems?
CVE-2025-6495 can allow attackers to execute arbitrary SQL queries, potentially leading to data breaches or system compromise.
Is user input validation sufficient to mitigate CVE-2025-6495?
No, proper escaping and prepared statements are necessary to mitigate CVE-2025-6495, as simple user input validation is not enough.