CVE-2026-18030 is a missing authorization vulnerability (CWE-862) in the BricksForge WordPress plugin versions prior to 3.1.8.8. The plugin does not verify the identity of the requester when handling password change requests submitted via one of its form actions. Because the server-side current-password verification is disabled by default, an unauthenticated attacker can submit a password change request and set an arbitrary password for any user account, including administrators, effectively allowing account takeover. Exploitation requires the site to use the vulnerable password reset action in update mode within a form powered by the affected plugin versions.

Successful exploitation allows an unauthenticated attacker to reset the password of any user on the affected WordPress site, including administrative accounts. This leads to full account takeover, compromising confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the vulnerable password reset form action or enable server-side current-password verification if configurable. Monitor official BricksForge plugin channels for updates and apply any released patches promptly.