CVE-2026-14956 describes a privilege escalation vulnerability in the Bricksforge WordPress plugin (up to version 3.1.8.6). The vulnerability is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This flaw permits unauthenticated attackers to create new administrator accounts by submitting specially crafted requests to publicly accessible Bricksforge Pro Forms registration forms configured with the User Registration action. The vulnerability is classified under CWE-269 (Improper Privilege Management) and has a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability to escalate privileges by registering a new administrator account on the affected WordPress site. This compromises the confidentiality, integrity, and availability of the site, allowing full administrative control. The attack requires a publicly accessible Bricksforge Pro Forms registration form configured with the User Registration action. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict public access to Bricksforge Pro Forms registration elements configured with the User Registration action to trusted users only. Monitor for updates from the plugin vendor and apply patches promptly once released.