CVE-2025-6495

Vulnerability

Overview The Bricks theme for WordPress versions up to 1.12.4 are vulnerable to blind SQL injection through the 'p' parameter. The issue arises from insufficient escaping of user-supplied input and inadequate preparation of the SQL query, allowing an unauthenticated attacker to append arbitrary SQL clauses to existing queries [1].

Exploitation

Details This vulnerability can be triggered without authentication. However, the injection is time-based or blind, meaning an attacker cannot directly read or modify database contents. Instead, they must infer information by observing response delays or other indirect techniques, making exploitation complex and less practical in real-world scenarios [1].

Impact

Assessment Successful exploitation could enable an attacker to extract sensitive information from the database, such as user credentials or configuration data, though the blind nature limits the efficiency of data retrieval. There is no evidence of active exploitation in the wild as of the advisory [1].

Mitigation

The vulnerability is patched in Bricks version 2.0 and also in a hotfix release 1.12.5. Users are strongly advised to update immediately. The vendor also provides instructions for applying the patch manually [1].