CVE-2022-3401 - CVE House
Back to Database
Status published High CVE-2022-3401

The Bricks theme for WordPress is vulnerable to remote code...

Vulnerability Description

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability (CVE-2022-3400), makes it possible for authenticated attackers with minimal permissions, such as a subscriber, can edit any page, post, or template on the vulnerable WordPress website and inject a code execution block that can be used to achieve remote code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-3401

Credits & Attribution

No credits recorded in the NVD database.

References

More from Bricks Builder

View All →
CVE-2025-6495
Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter
High 7.5
CVE-2024-2297
Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave
High 7.1
CVE-2023-3410
Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting
Medium 5.4
CVE-2023-3409
Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings
Medium 5.4
CVE-2023-3408
Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings
Medium 4.3

Affected Vendor

Bricks Builder

View all reports →

Affected Software

Bricks
Vulnerable Versions:
1.2

Timeline

Official Publish: October 28th, 2022
Last Modified: January 31st, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/A:H/I:H/C:H/S:U/UI:N/PR:L/AC:L/AV:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.