CVE-2024-2297: Privilege Escalation in Bricks WordPress Theme

Successful exploitation of CVE-2024-2297 allows an attacker to gain complete control over a WordPress site. By executing arbitrary PHP code with administrator privileges, an attacker can modify or delete content, install malicious plugins or themes, steal sensitive data (user credentials, database information), and potentially compromise the entire server. The vulnerability's reliance on specific configurations—Builder enabled for posts, Builder access for contributors, and 'Code Execution' enabled for administrators—limits its immediate impact but still presents a significant risk if these settings are in place. This is particularly concerning as many WordPress sites utilize the Bricks theme for its extensive customization options.

1. Reserved2024-03-07
2. Published2025-02-27
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-2297 is to immediately upgrade the Bricks WordPress theme to version 1.9.7 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the Builder functionality for contributor-level users. Additionally, ensure that 'Code Execution' is disabled for administrator users within the Bricks settings. While not a complete solution, these steps can significantly reduce the attack surface. Monitor WordPress access logs for suspicious activity related to the create_autosave AJAX endpoint. After upgrading, confirm the fix by attempting to trigger the vulnerable AJAX function with a contributor account and verifying that the action is denied.