CVE-2024-2297 Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave

What is CVE-2024-2297?

CVE-2024-2297 is a high-severity vulnerability in Bricks, published on 27 Feb 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the create_autosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code with elevated (administrator-level) privileges. NOTE: Successful exploitation requires (1) the Bricks Builder to be enabled for posts (2) Builder access to be enabled for contributor-level users, and (3) "Code Execution" to be enabled for administrator-level users within the theme's settings.

Weakness: CWE-269

Which versions are affected by CVE-2024-2297?

It affects 1 product.

Products include Bricksbuilder Bricks.

How do I fix CVE-2024-2297?

No fix has been published for CVE-2024-2297 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-2297 being exploited?

There is no known exploitation of CVE-2024-2297 in the wild and no public exploit code.

Other vulnerabilities in Bricks

• CVE-2022-3401 Code injection in Bricks High 8.8
• CVE-2022-3400 Missing authorization in Bricks Medium 6.5
• CVE-2023-3410 Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting Medium 5.4
• CVE-2023-3409 Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings Medium 5.4
• CVE-2023-3408 Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6m6j-3p57-wq75.