CVE-2026-18030

Name of the Vulnerable Software and Affected Versions BricksForge WordPress plugin versions prior to 3.1.8.8

Description An issue exists where the plugin fails to verify the identity of the requester during a password change submitted via a form action. This allows unauthenticated attackers to set an arbitrary password for any user, including administrators, leading to full account takeover. This occurs when a site uses the password reset action in update mode. By default, the server-side current-password verification option for this action is disabled.

Recommendations Update the BricksForge WordPress plugin to version 3.1.8.8 or later.