CVE-2026-118803: Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the queryresult REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as authormeta:userpass, authormeta:useremail, or cfcouponamount to leak post meta and the post author's user record, including the password hash, without authentication.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
Bricks Theme versions 2.4.3 and earlier are affected. The issue is reachable through the query_result REST endpoint and does not require authentication.
What does an attacker need to exploit this issue?
An attacker only needs network access to the vulnerable REST endpoint. They can control the urlParams object so that a submitted value is re-parsed as a Bricks dynamic-data tag.
What data could be disclosed?
An attacker may use injected tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to retrieve post metadata and the post author’s user record. The disclosed author data can include a password hash.
What version addresses the issue?
The affected range is 2.4.3 and before, and the referenced Bricks release is 2.4.4. Upgrading beyond the affected range addresses the identified exposure.