{"affected":[{"defaultStatus":"unaffected","product":"Bricks Theme","source":"CNA: VulnCheck","vendor":"Bricks","versions":[{"lessThan":"2.4.4","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118803","cwes":["CWE-1336"],"description":"Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.","epss":{"date":"2026-11-02","percentile":0.30743,"score":0.00369},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793713442834,"publishedAt":1793221892437,"references":[{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://bricksbuilder.io/release/bricks-2-4-4/"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/bricks-theme-unauthenticated-dynamic-data-tag-injection-via-query-result"}],"remediation":[],"revision":"a8bafc58a757b98c7ad6aa6a198c61fd8646427e517df35d516732ea66885d52","sources":[{"modifiedAt":1793713442834,"name":"CNA: VulnCheck","retrievedAt":1793714964893,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118803"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793715001706,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118803"}],"ssvc":{"assessedAt":1793713403962,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result","updatedAt":1793715001706}