Bricks WordPress Theme Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Bricks WordPress theme, affecting all versions through 1.9.6.1. The issue arises from inadequate validation on the create_autosave AJAX function, allowing authenticated attackers with contributor-level access or higher to execute arbitrary PHP code with administrator privileges. Successful exploitation requires the Bricks Builder to be active for posts, Builder access for contributor-level users, and 'Code Execution' enabled for administrators in the theme settings.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling contributors to execute code with administrator rights.

Remediation

Users are advised to update to Bricks version 1.9.7 or a later patched version.