CVE-2026-14956: Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bricksforge (WordPress)to a version that resolves this vulnerability.Fixed in 3.1.8.6 - Configuration
Ensure the Bricksforge Pro Forms element that includes the 'User Registration' action is not publicly accessible (remove the public Pro Forms element or restrict access) to prevent unauthenticated attackers from submitting crafted requests to the registration form.
Bricksforge Pro Forms User Registration action = not publicly accessible (restrict/remove public exposure)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14956?
CVE-2026-14956 has a severity score of 9.8, indicating it is a critical vulnerability.
How do I fix CVE-2026-14956?
To fix CVE-2026-14956, update the Bricksforge plugin to the latest version beyond 3.1.8.6.
What type of attack does CVE-2026-14956 allow?
CVE-2026-14956 allows for unauthenticated privilege escalation through improper validation of the fieldIds parameter.
Which versions of Bricksforge are affected by CVE-2026-14956?
CVE-2026-14956 affects all versions of the Bricksforge plugin up to and including 3.1.8.6.
Where can I find more information about CVE-2026-14956?
More information about CVE-2026-14956 can typically be found in the plugin's changelog and security advisories.