CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-14956 — The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in al...

·Source: NIST NVD

Updated:

Executive Summary

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator acco

Analysis

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action. CVSS Score: 9.8. Published: 2026-07-17T02:18:03.870.

Indicators of Compromise (2)

CVE (1)
CVE-2026-14956
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 17, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Trump Revives Debunked Election Hacking Claims

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/trump-set-to-revive-debunked-election-hacking-claims-image_small-2-a-32249.jpg" align=right hspace=4><b>Courts, Audits and Federal Agencies Found No Evidence 2020 Votes Were Altered</b><br>U.S. President Donald Trump used a primetime address Thursday night to allege that China carried out a sweeping compromise of American voter da

Bank Info Security
CRITICALVulnerability

NVD CRITICAL: CVE-2026-62241 — clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT...

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known

CVE-2026-62241
NIST NVD
MEDIUMVulnerability

HSBC joins digital gilt pilot as investor depository

The London Stock Exchange Group and HSBC have come together to support HM Treasury's Digital Gilt Instrument (Digit) pilot issuance

Finextra