Bricks 1.9.6.1 Patches Critical RCE Vulnerability
First disclosed by security researcher Calvin Alkan of snicco, the vulnerability impacts all versions of Bricks Builder before version 1.9.6.1. Identified as a Remote Code Execution (RCE) flaw, it poses a critical security risk, allowing attackers to potentially gain unauthorized control over websites running on an affected version of Bricks. What is Bricks? Bricks or Bricks Builder is a visual site builder that allows users to create web pages on WordPress without using code through their drag-and-drop interface. Unlike other similar products in the WordPress ecosystem which deliver functionality through plugins, the Bricks Builder uses the theme functionality as it’s way of delivering features to users. Understanding RCE Vulnerabilities RCE vulnerabilities are among the most critical types of security flaws. They allow attackers to execute arbitrary code on a website from a remote location, allowing them to control the site, access confidential data, distribute malware, and more. Timeline of the Patch The vulnerability disclosure timeline is commendable for its efficiency. The flaw was reported to Bricks by security research team snicco on February 10, 2024, marking the start of a swift and effective response. Bricks acknowledged the issue on the same day and, by February 13, had released the patch…
…Full post on WP Tavern
Read Full
