The BricksForge WordPress plugin (prior to 3.1.8.8) fails to verify the identity of a user when handling a password reset submitted through one of its form actions. As a result, anyone who can submit that form can set a new password for any user account, including administrators, and take control of the site. This vulnerability is an authentication bypass (CWE‑862) that allows an attacker to obtain full administrative privileges without needing any prior credentials.

The issue exists in any WordPress installation that uses BricksForge plugin versions older than 3.1.8.8. It is triggered only when a form that uses the plugin’s password reset action in update mode is present on the site. The vulnerability is present by default because the server‑side current‑password check is disabled, so any site with the vulnerable form will be affected.

Because the vulnerability is exploitable without authentication and only requires a standard HTTP request to a public form, the risk of compromise is high. The CVSS score is 8.1, and the EPSS score is < 1%, indicating a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the reset simply by sending a crafted POST request to the plugin’s reset endpoint, making this a readily exploitable flaw with a high likelihood of impact once a site hosts the vulnerable form.