Threats tagged 'ghsa-33cw-hwxh-f8g5'

Bricks Theme versions 2.4.3 and earlier have an unauthenticated dynamic-data tag injection vulnerability. This flaw allows anonymous attackers to manipulate the urlParams object in the query_result REST endpoint, causing injected values to be re-parsed as dynamic data tags. Exploitation can lead to leakage of sensitive post meta information and the post author's user record, including password hashes, without requiring authentication.