https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 07:14:00 +0000 https://vulnerability.circl.lu/vuln/cve-2026-18030 <p><strong>Affected:</strong> Unknown BricksForge</p> <p>The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.</p> <p>Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8&#39;s password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.</p> <p><strong>Affected:</strong> Unknown BricksForge</p> <p>The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.</p> <p>Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8&#39;s password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.</p> https://vulnerability.circl.lu/vuln/cve-2026-18030