A high-severity vulnerability has been identified in the Bricks theme for WordPress, a popular website-building tool. This flaw allows an unauthenticated attacker to steal sensitive information directly from the website's database, such as user credentials, customer data, and other private content. Due to the ease of exploitation and the potential for a complete data breach, immediate patching is critical to protect affected websites.

The vulnerability is a blind SQL Injection in the Bricks WordPress theme. An unauthenticated remote attacker can exploit this by sending a specially crafted SQL query within the ‘p’ parameter of a web request. Because the injection is "blind," the server does not return database output directly in its response. Instead, the attacker uses time-based or boolean-based techniques to infer the database structure and exfiltrate data one character at a time by observing delays or subtle changes in the server's response. This can ultimately lead to the full extraction of database contents.

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could lead to significant business consequences, including the unauthorized disclosure of sensitive data such as customer Personally Identifiable Information (PII), user passwords, and proprietary business information. A successful attack could result in severe reputational damage, loss of customer trust, regulatory fines (e.g., GDPR, CCPA), and the potential for a complete website takeover if administrative credentials are stolen from the database.

Immediate Action: Immediately update the Bricks theme to the latest patched version provided by the vendor. After applying the update, perform a security audit of the WordPress site. If the Bricks theme is installed but no longer in use, it should be deactivated and permanently removed to eliminate it as a potential attack vector.

Proactive Monitoring: Monitor web server and Web Application Firewall (WAF) logs for suspicious requests targeting the ‘p’ parameter. Specifically, look for requests containing SQL keywords (e.g., SELECT, UNION, SLEEP, BENCHMARK) or an unusual number of special characters. Monitor database logs for an increase in slow queries or unexpected commands originating from the web server, which could indicate time-based injection attempts.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with a robust ruleset to detect and block SQL injection attacks. Ensure the WAF is in blocking mode, not just logging mode. Additionally, ensure the database user account used by the WordPress application operates with the principle of least privilege, restricting its ability to access or modify critical data outside of its intended function.

Public Exploit Available: False

Given the high severity (CVSS 7.5) and the potential for unauthenticated remote data exfiltration, we strongly recommend that all organizations using the Bricks theme for WordPress treat this vulnerability with urgency. The recommended patch should be applied immediately. Although this CVE is not currently listed on the CISA KEV list, its critical nature makes it an attractive target for widespread, automated attacks. Proactive patching is the most effective defense against a potential data breach.