The Bricks theme for WordPress contains a blind SQL injection flaw in the ‘p’ parameter that is sent to the server. Because the value supplied by the user is not properly escaped or prepared, an attacker can append additional SQL statements to the existing query. This allows an unauthenticated user to read sensitive information from the database, posing a risk to data confidentiality. The vulnerability is categorized as a CWE‑89 input validation weakness, consistent with other injection-based flaws.

Bricks Builder versions 1.12.4 and all earlier releases deployed within WordPress installations are affected. Sites utilizing Bricks as the primary theme without an upgrade to the 2.0 release fall within the scope of this issue.

The CVSS score of 7.5 highlights a medium‑to‑high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Attackers would need to craft an unauthenticated HTTP request containing a malicious ‘p’ parameter; the injection is blind, meaning the attacker may not directly receive query results without additional probing. Nonetheless, successful exploitation could expose database contents and other sensitive data.