---
id: CVE-2026-118803
title: Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
summary: >-
  Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag
  injection vulnerability that allows anonymous attackers to control the
  urlParams object in the query_result REST endpoint, causing the submitted
  value to be re-pa…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-1336
vendor: Bricks
product: Bricks Theme
affected:
  - theme < 2.4.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T13:43:23.962657Z'
published: '2026-10-28'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:44:02.834Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118803'
references:
  - url: 'https://bricksbuilder.io/release/bricks-2-4-4/'
  - url: >-
      https://www.vulncheck.com/advisories/bricks-theme-unauthenticated-dynamic-data-tag-injection-via-query-result
    label: >-
      VulnCheck Advisory: Bricks Theme Unauthenticated Dynamic Data Tag
      Injection via query_result
tags:
  - cve.org
epss: 0.00369
epssPercentile: 0.30907
ingestedAt: '2026-11-03T01:34:34.642Z'
---

## Overview

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.

## Affected

- `theme < 2.4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.