CVE-2026-14956

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.7

Description The Bricksforge plugin for WordPress contains a privilege escalation flaw. The issue stems from improper validation of the fieldIds parameter within the Pro Forms registration action. This allows unauthenticated attackers to add attacker-supplied field IDs to the trusted form-field whitelist. By submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form, an attacker can register a new administrator account. This exploitation is possible if the site has a public Bricksforge Pro Forms element configured with the User Registration action.

Recommendations Update to version 3.1.8.7 or later. Restrict public registration forms to minimize the risk of exploitation. Audit administrator accounts for unauthorized entries.