CVE-2026-18030: Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.
Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BricksForge WordPress pluginto a version that resolves this vulnerability.Fixed in 3.1.8.8 - Configuration
Enable the server-side current-password verification for the password reset action (in update mode) so the plugin verifies the identity of the requester when processing password changes submitted through its form actions.
BricksForge WordPress plugin server-side current-password verification option for the password reset action (update mode) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18030?
CVE-2026-18030 has a risk score of 83, indicating it is a high-severity vulnerability.
What does CVE-2026-18030 allow an attacker to do?
CVE-2026-18030 allows unauthenticated attackers to reset passwords for any user, including administrators, without verification.
How do I fix CVE-2026-18030?
To fix CVE-2026-18030, update the Bricksforge WordPress plugin to version 3.1.8.8 or later.
Which version of Bricksforge is affected by CVE-2026-18030?
CVE-2026-18030 affects all versions of the Bricksforge WordPress plugin prior to 3.1.8.8.
Is there a workaround for CVE-2026-18030?
Currently, the recommended action for CVE-2026-18030 is to update to the latest version of the plugin as there is no specific workaround.