CVE-2026-34888: WordPress Bricksforge plugin <= 3.1.8.4 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.
Metrics
- CVSS v3.1
- 7.5
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
HarborGuard Analysis
Synopsis
This is a sensitive data exposure vulnerability in the Bricksforge WordPress plugin, affecting versions 3.1.8.4 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed, as reflected in the CVSS vector. Successful exploitation allows an unauthenticated remote attacker to read sensitive data from the affected WordPress installation. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.
HarborGuard Coverage
Detection is available across every HarborGuard environment: the CVE is ingested from upstream feeds including Patchstack within minutes of publication and matched against all customer images, including custom-built images that bundle the Bricksforge plugin. Any image at or below version 3.1.8.4 is flagged automatically.
AvailableTriage is available with a CVSS 3.1 score of 7.5 (HIGH) applied immediately on match, weighted against each customer organization's compliance policy to determine urgency. Findings are routed to the appropriate team inbox within each customer environment based on configured ownership rules.
AvailableBecause no fix version has been published upstream for CVE-2026-34888, HarborGuard re-checks the Patchstack advisory on every ingest cycle and will make a patched-image rebuild available automatically the moment an upstream fix ships. For customers who opt into auto-remediation, the rebuild, regression test run, and PR against affected workloads will be triggered without manual intervention once a fix version becomes available.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The attacker must reach the WordPress service over the network; no local or physical access is needed.
- AuthenticationNot required
No account or credentials of any kind are needed to trigger the vulnerability.
- Victim interactionNot required
The attacker does not need to trick or involve any user to carry out the exploit.
- Attack complexityDetail
The exploit is reliable and condition-free, with no race conditions or special environmental prerequisites required.
Blast Radius
- An unauthenticated remote attacker reads sensitive data exposed by the plugin, which may include configuration values, credentials, API keys, or user records stored or accessible by Bricksforge.
- Confidentiality of the WordPress installation is fully compromised for the affected data surface; integrity and availability of stored data are not directly affected by this vulnerability.
- Exposed data can be used as a stepping stone for further attacks against the site, its users, or connected third-party services.
How HarborGuard Handles This
Available on HarborGuard: since no upstream fix exists yet, HarborGuard monitors the Patchstack advisory on every ingest cycle and will surface a patched-image rebuild the moment a fix version is published. In the interim, customers are advised to apply network-policy controls that restrict public access to the WordPress endpoints served by Bricksforge, use egress filtering to limit what the plugin can reach externally, and consider disabling or removing the plugin in environments where it is not actively needed. When a fix is published, customers with auto-remediation enabled will receive an automatic rebuild, regression test run, and a PR opened against affected workloads without requiring manual steps.
- Bricksforge / Bricksforge≤ 3.1.8.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N