CVE-2026-118803

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author meta:user pass, author meta:user email, or cf coupon amount to leak post meta and the post author's user record, including the password hash, without authentication.