Bricks Builder Theme: Unauthenticated Remote Code Execution

Threat Overview

A maximum-severity unauthenticated Remote Code Execution (RCE) vulnerability in Bricks—a performance-focused WordPress theme and visual site builder—is under active, widespread exploitation in the wild and has been cataloged by CISA in its Known Exploited Vulnerabilities (KEV) database. Tracked as CVE-2024-25600 with a 9.8 CVSS score, the flaw allows unauthenticated remote attackers to pass arbitrary PHP commands directly into the server’s eval() execution function via the theme’s public REST API, causing instantaneous server compromise.

The Breakdown: How the Exploit Works

The vulnerability resides in Bricks’ dynamic element rendering endpoint, which is exposed to handle live canvas updates and custom database query loops.

When rendering visual elements through the REST API, the endpoint checks for a WordPress security nonce. However, Bricks provides these nonces publicly to unauthenticated visitors in frontend page markup to support frontend dynamic features. Once an attacker extracts this public nonce, they can dispatch an unauthenticated POST request to /wp-json/bricks/v1/render_element.

Crucially, the endpoint fails to verify user permissions and permits the submission of custom query settings. Inside the prepare_query_vars_from_settings() function, if the useQueryEditor parameter is enabled, Bricks feeds the user-provided code string directly into PHP’s native eval() function without sanitization. Attackers simply submit raw PHP system commands (system(), passthru()), which the underlying server immediately executes with web-server privileges.

The Operational Risk: What an Attacker Gains

Because active exploitation is heavily automated and weaponized across the global internet, vulnerable sites face immediate catastrophe:

• Instantaneous Server Takeover: Threat actors deploy persistent PHP webshells, create hidden backdoor administrators, and disable WordPress security plugins.
• Malicious Redirection & Botnets: Compromised sites are recruited into distributed denial-of-service botnets or injected with deceptive redirects targeting site visitors.

Our Take in Plain English

“Passing untrusted user input into an eval() statement on a live web server is one of the most dangerous anti-patterns in software engineering. Modern visual builders attempt to deliver complete code-level flexibility to designers, but doing so within a dynamic PHP environment creates catastrophic attack surfaces. On a modern pre-rendered architecture, page components are rendered strictly at build time, completely banishing runtime evaluation functions from production edge servers.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Employs runtime PHP evaluation and dynamic REST rendering on the live production server, enabling arbitrary code execution through unvalidated API endpoints.
• Modern Pre-Rendered Architecture: Pre-renders all layout components into static edge assets during secure build pipelines, entirely eliminating runtime code execution engines on the public web.

Immediate Action Items for WordPress Operators

1. Upgrade Bricks Immediately: Update to Bricks version 1.9.6.1 or higher, which completely removes dynamic code evaluation from unauthenticated REST endpoints.
2. Scan for Compromise Artifacts: Inspect wp-content/uploads/ and root WordPress directories for unauthorized .php files or suspicious base64-encoded strings.
3. Block render_element Access: If an immediate update is impossible, block all external requests to /wp-json/bricks/v1/render_element at your web application firewall.