CVE-2024-2297 is a privilege escalation vulnerability affecting the Bricks theme for WordPress, specifically versions up to and including 1.9.6.1. It stems from insufficient validation in the create_autosave AJAX function, allowing authenticated attackers with contributor-level access to execute arbitrary PHP code with administrator privileges. The vulnerability carries a high CVSS score of 8.8, indicating a severe impact with high confidentiality, integrity, and availability risks. Exploitation is network-based and low complexity, but requires specific Bricks theme configurations: the builder enabled for posts, builder access for contributors, and "Code Execution" enabled for administrators. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the majority of vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.9.7CPE matchmatch criteria | cpe:2.3:a:bricksbuilder:bricks:*:*:*:*:*:wordpress:*:* | ||
>= 0, <= 1.9.6.1CPE match | cpe:2.3:a:bricksbuilder:bricks:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.