The Bricksforge plugin for WordPress contains an unauthenticated privilege escalation flaw in all versions up to and including 3.1.8.6. This vulnerability, identified as CWE-269, arises from improper validation of the fieldIds parameter in the Pro Forms registration action, allowing attacker‑supplied field IDs to be added to the trusted form‑field whitelist. A crafted request to a publicly accessible Pro Forms registration form can create a new administrator account without requiring any preexisting credentials.

Affected systems are WordPress sites that have the Bricksforge plugin installed with a public Pro Forms element configured for the User Registration action. The vulnerability applies to any version of the plugin through 3.1.8.6, regardless of the site’s overall configuration beyond the presence of the form.

The CVSS score of 9.8 indicates a critical impact, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Successful exploitation requires an accessible registration form; the attacker would send a POST request including crafted fieldIds, and the plugin would trust those fields and proceed to create an admin account.