BricksForge Plugin Missing Authentication in Password Reset

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-18030 exposes a critical authentication bypass vulnerability in the BricksForge WordPress plugin versions before 3.1.8.8. The plugin fails to verify the identity of users submitting password change requests through its form actions, enabling unauthenticated attackers to arbitrarily reset passwords for any account—including administrators. This vulnerability is particularly dangerous because WordPress sites using BricksForge with password reset forms in update mode become instant targets for account takeover attacks. Any WordPress installation running the affected plugin version with exposed password reset forms is at risk, making this a widespread threat across the BricksForge user base.

Casky's 283 mapped skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across both MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns including: unauthenticated POST requests to password reset endpoints lacking proper nonce verification or session validation, unusual password change submissions without corresponding authentication tokens, and detection of form submissions bypassing the server-side current-password verification controls. The platform's skill mapping would flag insufficient access controls (CWE-862) manifesting as requests that modify user credentials without proper identity confirmation, allowing security teams to detect exploitation attempts in real-time through authentication anomalies and unauthorized privilege escalation activities on their WordPress infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18030.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-18030

Casky has 283 skills that investigate the attack patterns behind CVE-2026-18030. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn