{"id":"CVE-2024-25600","aliases":["EUVD-2024-22928","GHSA-4rxr-g7cg-rwg8"],"status":"published","title":"WordPress Bricks Theme \u003c= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.91074,"percentile":0.9981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2024-06-04T12:51:27Z","modified":"2026-06-17T07:16:14Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/wp_bricks_builder_rce","title":"Unauthenticated RCE in Bricks Builder Theme","type":"exploit","platform":"Linux,PHP,Unix,Windows","date":"2024-02-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_bricks_builder_rce"},{"source":"pocgithub","id":"Chocapikk/CVE-2024-25600","title":"Chocapikk/CVE-2024-25600","date":"2024-02-20","url":"https://github.com/Chocapikk/CVE-2024-25600"},{"source":"pocgithub","id":"Christbowel/CVE-2024-25600_Nuclei-Template","title":"Christbowel/CVE-2024-25600_Nuclei-Template","date":"2024-02-21","url":"https://github.com/Christbowel/CVE-2024-25600_Nuclei-Template"},{"source":"pocgithub","id":"Tornad0007/CVE-2024-25600-Bricks-Builder-plugin-for-WordPress","title":"Tornad0007/CVE-2024-25600-Bricks-Builder-plugin-for-WordPress","date":"2024-02-22","url":"https://github.com/Tornad0007/CVE-2024-25600-Bricks-Builder-plugin-for-WordPress"},{"source":"pocgithub","id":"X-Projetion/WORDPRESS-CVE-2024-25600-EXPLOIT-RCE","title":"X-Projetion/WORDPRESS-CVE-2024-25600-EXPLOIT-RCE","date":"2024-04-20","url":"https://github.com/X-Projetion/WORDPRESS-CVE-2024-25600-EXPLOIT-RCE"},{"source":"pocgithub","id":"svchostmm/CVE-2024-25600-mass","title":"svchostmm/CVE-2024-25600-mass","date":"2024-05-17","url":"https://github.com/svchostmm/CVE-2024-25600-mass"},{"source":"pocgithub","id":"NanoWraith/CVE-2024-25600","title":"NanoWraith/CVE-2024-25600","date":"2024-06-06","url":"https://github.com/NanoWraith/CVE-2024-25600"},{"source":"pocgithub","id":"WanLiChangChengWanLiChang/CVE-2024-25600","title":"WanLiChangChengWanLiChang/CVE-2024-25600","date":"2024-06-06","url":"https://github.com/WanLiChangChengWanLiChang/CVE-2024-25600"},{"source":"pocgithub","id":"KaSooMi0228/CVE-2024-25600-Bricks-Builder-WordPress","title":"KaSooMi0228/CVE-2024-25600-Bricks-Builder-WordPress","date":"2024-07-30","url":"https://github.com/KaSooMi0228/CVE-2024-25600-Bricks-Builder-WordPress"},{"source":"pocgithub","id":"diamorphine666/CVE-2024-25600","title":"diamorphine666/CVE-2024-25600","date":"2024-08-20","url":"https://github.com/diamorphine666/CVE-2024-25600"},{"source":"pocgithub","id":"Sibul-Dan-Glokta/test-task-CVE-2024-25600","title":"Sibul-Dan-Glokta/test-task-CVE-2024-25600","date":"2025-01-26","url":"https://github.com/Sibul-Dan-Glokta/test-task-CVE-2024-25600"},{"source":"pocgithub","id":"so1icitx/CVE-2024-25600","title":"so1icitx/CVE-2024-25600","date":"2025-03-31","url":"https://github.com/so1icitx/CVE-2024-25600"},{"source":"pocgithub","id":"ivanbg2004/ODH-BricksBuilder-CVE-2024-25600-THM","title":"ivanbg2004/ODH-BricksBuilder-CVE-2024-25600-THM","date":"2025-04-09","url":"https://github.com/ivanbg2004/ODH-BricksBuilder-CVE-2024-25600-THM"},{"source":"pocgithub","id":"DedsecTeam-BlackHat/Poleposph","title":"DedsecTeam-BlackHat/Poleposph","date":"2025-05-09","url":"https://github.com/DedsecTeam-BlackHat/Poleposph"},{"source":"pocgithub","id":"r0otk3r/CVE-2024-25600","title":"r0otk3r/CVE-2024-25600","date":"2025-07-10","url":"https://github.com/r0otk3r/CVE-2024-25600"},{"source":"pocgithub","id":"Anjai7/TryHack3M-Bricks-Heist","title":"Anjai7/TryHack3M-Bricks-Heist","date":"2025-08-09","url":"https://github.com/Anjai7/TryHack3M-Bricks-Heist"},{"source":"pocgithub","id":"ranjithxploit/CVE-2024-25600","title":"ranjithxploit/CVE-2024-25600","date":"2025-11-28","url":"https://github.com/ranjithxploit/CVE-2024-25600"},{"source":"pocgithub","id":"zxc2009/TryHack3M-Bricks-Heist","title":"zxc2009/TryHack3M-Bricks-Heist","date":"2026-01-13","url":"https://github.com/zxc2009/TryHack3M-Bricks-Heist"},{"source":"pocgithub","id":"estebanzarate/CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC","title":"estebanzarate/CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC","date":"2026-02-18","url":"https://github.com/estebanzarate/CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC"},{"source":"exploitdb","id":"EDB-52619","title":"WordPress Bricks Builder Theme  -  RCE","type":"webapps","platform":"multiple","date":"2026-07-07","url":"https://www.exploit-db.com/exploits/52619"},{"source":"pocgithub","id":"CerberusMrXi/WP-Bricks-Exploit-CVE-2024-25600","title":"CerberusMrXi/WP-Bricks-Exploit-CVE-2024-25600","date":"2026-07-16","url":"https://github.com/CerberusMrXi/WP-Bricks-Exploit-CVE-2024-25600"},{"source":"pocgithub","id":"eunbyulaakash/CVE-2024-25600-FOR-PYTHON-3.8-AND-ABOVE","title":"eunbyulaakash/CVE-2024-25600-FOR-PYTHON-3.8-AND-ABOVE","date":"2026-11-03","url":"https://github.com/eunbyulaakash/CVE-2024-25600-FOR-PYTHON-3.8-AND-ABOVE"},{"source":"nuclei","id":"CVE-2024-25600","title":"Unauthenticated Remote Code Execution – Bricks \u003c= 1.9.6","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25600.yaml"}],"products":[{"vendor":"bricks","product":"bricks builder"},{"vendor":"bricksbuilder","product":"bricks"},{"vendor":"codeer limited","product":"bricks builder"}],"references":[{"url":"https://patchstack.com/database/vulnerability/bricks/wordpress-bricks-theme-1-9-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6","tags":["third-party-advisory","technical-description","x_transferred"]},{"url":"https://patchstack.com/articles/critical-rce-patched-in-bricks-builder-theme?_s_id=cve","tags":["third-party-advisory","technical-description","x_transferred"]},{"url":"https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT","tags":["exploit","x_transferred"]},{"url":"https://github.com/Chocapikk/CVE-2024-25600","tags":["exploit","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25600"},{"url":"https://github.com/advisories/GHSA-4rxr-g7cg-rwg8"}],"sources":{"cve":[{"id":"CVE-2024-25600","title":"WordPress Bricks Theme \u003c= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.","status":"published","published":"2024-06-04T12:51:27.971Z","modified":"2026-04-28T16:09:12.815Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:04.341725Z"}],"euvd":[{"id":"EUVD-2024-22928","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.","status":"published","published":"2024-06-04T12:51:27Z","modified":"2026-04-28T16:09:12Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:00.294333Z"}],"ghsa":[{"id":"GHSA-4rxr-g7cg-rwg8","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks...","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.","status":"published","published":"2024-06-04T15:30:58Z","modified":"2024-06-04T15:30:58Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:57:25.483683Z"}],"nvd":[{"id":"CVE-2024-25600","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.","status":"published","published":"2024-06-04T13:15:51.183Z","modified":"2026-06-17T07:16:14.55Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:03.465199Z"}]}}