Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) 権限昇格 (Privilege Escalation) via create_autosave

Successful exploitation of CVE-2024-2297 allows an attacker to gain complete control over a WordPress site. By executing arbitrary PHP code with administrator privileges, an attacker can modify or delete content, install malicious plugins or themes, steal sensitive data (user credentials, database information), and potentially compromise the entire server. The vulnerability's reliance on specific configurations—Builder enabled for posts, Builder access for contributors, and 'Code Execution' enabled for administrators—limits its immediate impact but still presents a significant risk if these settings are in place. This is particularly concerning as many WordPress sites utilize the Bricks theme for its extensive customization options.

WordPress sites utilizing the Bricks theme, particularly those with contributor-level users granted access to the Builder and administrators who have enabled 'Code Execution' within the Bricks settings, are at significant risk. Shared hosting environments where WordPress installations are managed by the hosting provider are also vulnerable if they haven't applied the update.

• wordpress / composer / npm:

grep -r 'create_autosave' /var/www/html/wp-content/plugins/bricks-builder/

• wordpress / composer / npm:

wp plugin list | grep bricks-builder

• wordpress / composer / npm:

wp option get bricks_builder_settings | grep 'enable_builder_for_contributors'

• wordpress / composer / npm:

wp option get bricks_builder_settings | grep 'enable_code_execution'

1. 2025-02-27Disclosure

   disclosure

1. 予約済み2024-03-07
2. 公開日2025-02-27
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-2297 is to immediately upgrade the Bricks WordPress theme to version 1.9.7 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the Builder functionality for contributor-level users. Additionally, ensure that 'Code Execution' is disabled for administrator users within the Bricks settings. While not a complete solution, these steps can significantly reduce the attack surface. Monitor WordPress access logs for suspicious activity related to the create_autosave AJAX endpoint. After upgrading, confirm the fix by attempting to trigger the vulnerable AJAX function with a contributor account and verifying that the action is denied.