summary: An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.


default_status: unaffected

product: FDS 102

vendor: Frauscher Sensortechnik

status: affected

version_type: semver

ecosystem: software/application

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Received

summary: A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.

title: Frauscher Sensortechnik Fds 102 security vulnerability


vendor: Themehigh

ecosystem: php/wordpress

status: Deferred

summary: The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

title: Themehigh Checkout Field Editor For Woocommerce (Pro) security vulnerability


product: Bricksforge

vendor: Bricksforge

author: Codex

content_markdown:
CVE-2026-14956 is a critical privilege-escalation vulnerability in the
Bricksforge plugin for WordPress. Wordfence, acting as the CVE Numbering
Authority, reports that an unauthenticated attacker can submit attacker-chosen
field identifiers to a public Bricksforge Pro Forms registration form and cause
the registration action to create a WordPress administrator account.

The disclosed attack path exists only when both conditions are true:

1. Bricksforge is running version `3.1.8.6` or earlier.
2. A publicly accessible Pro Forms element uses the **User Registration**
   action.

Bricksforge identifies version `3.1.8.7` as the release that fixed the Pro Forms
privilege-escalation issue. Upgrade to `3.1.8.7` or a later vendor-supported
release. Do not use a third-party package or infer that a later unrelated
version is the first fixed release.

## Evidence basis and limits

This recipe is based on the Wordfence CNA record, the Bricksforge version
changelog, Bricksforge Pro Forms documentation, official WP-CLI command
documentation, live GHAD `GHSA-3h83-c8w5-cccx`, and NVD. Live GHAD has
**vulnerabilities empty**. NVD is **Deferred** with **empty CPE**.
**3.1.8.7 is not an NVD exclude.** Do not invent a later 3.1.8.8 floor.

The CNA record defines the affected semver range as `0` through `3.1.8.6`
inclusive, with other versions unaffected by default. It assigns CVSS 3.1 score
9.8 and CWE-269, Improper Privilege Management. The Bricksforge changelog for
`3.1.8.7`, dated 2026-07-14, explicitly names CVE-2026-14956 and says that the
release fixed the Pro Forms submission-handling privilege escalation.

The public sources do not expose the commercial plugin's private patch or prove
the state of any particular WordPress site. This recipe therefore does not
invent vulnerable PHP code, a patch diff, or an exploit payload. Confirm the
installed package, form configuration, and live deployment through approved
read-only evidence.

## When to use this recipe

Use it when a repository, scanner result, asset inventory, or incident ticket
identifies Bricksforge on a WordPress site and the task is scoped to
CVE-2026-14956. The repository may own Composer or deployment artifacts,
plugin-package checksums, container images, WordPress configuration, form
templates, release runbooks, inventory policy, or regression tests.

Do not use it to send a crafted `fieldIds` request, create a test administrator
through the vulnerable route, download Bricksforge from an unofficial source,
or make an unapproved production change.

## Inputs

- The site owner, environment, change window, and exact authorized boundary.
- The installed Bricksforge version from WP-CLI, the WordPress administration
  interface, a signed inventory, or a package manifest.
- A list of published pages and templates containing a Bricksforge Pro Forms
  element, including the configured action list and public reachability.
- The approved Bricksforge Customer Dashboard package or vendor-supported
  updater and its integrity evidence.
- Repository-controlled deployment definitions, plugin checksums, image pins,
  release notes, smoke tests, backups, and rollback procedure.
- An approved administrator-account inventory and incident-response owner if
  the affected configuration was publicly reachable.

Do not commit customer data, credentials, license keys, database dumps, raw
access logs, or private plugin packages to the repository.

## Affected and fixed versions

| Bricksforge version | CVE-2026-14956 status | Required action |
| --- | --- | --- |
| `0` through `3.1.8.6`, inclusive | Affected when a public Pro Forms element uses User Registration | Upgrade and assess exposure |
| `3.1.8.7` or later vendor-supported release | Contains the vendor-documented fix | Verify the deployed package and form behavior |

There is **no GHAD first_patched** and **no NVD CPE floor**. Use the
vendor-named **3.1.8.7** only. Version alone does not prove that the
disclosed route was reachable. A site on
an affected version still requires the public Pro Forms User Registration
configuration for the exact CNA-described exploitation condition. Conversely,
removing that configuration does not make vulnerable software fixed.

## How to check exposure for CVE-2026-14956

1. Identify the installed plugin directory name from approved inventory. Do not
   assume it when the deployment renames or vendors plugins.
2. For a standard `bricksforge` installation, collect the version read-only:

   ```bash
   wp plugin get bricksforge --field=version
   ```

3. Inspect published Bricks templates and pages for enabled Pro Forms elements.
   Bricksforge documents form actions in the Pro Forms element's **Actions**
   settings.
4. Record whether **User Registration** is configured and whether an
   unauthenticated visitor can reach the page containing that form.
5. Classify the exact disclosed exposure as confirmed only when the deployed
   version is `3.1.8.6` or earlier and that public configuration is present.
6. If version or configuration evidence is missing, stop with a triage record;
   do not prove exposure by submitting attacker-controlled field identifiers.

## Temporary containment

If an approved upgrade cannot be completed immediately, prepare a time-bounded
change to unpublish the affected registration page or disable the User
Registration action on publicly reachable Pro Forms elements. This is a
conservative inference from the CNA's required exposure condition, not a
vendor-published mitigation and not a substitute for upgrading.

Record the service impact, owner approval, exact configuration diff, expiry,
and restoration plan. Do not silently disable a business-critical registration
workflow.

## How to remediate CVE-2026-14956

1. Obtain Bricksforge `3.1.8.7` or later from the licensed vendor updater or
   Bricksforge Customer Dashboard.
2. Preserve the approved package checksum, source, version, and acquisition
   time in the change evidence without committing the commercial package.
3. Update every repository-controlled plugin pin, checksum, container layer,
   deployment manifest, inventory policy, and runbook that can reinstall the
   affected release.
4. Back up the site and database through the existing recovery process. Confirm
   that the backup is restorable and protected from public access.
5. Deploy through the site's normal staged release path. Keep cache purge,
   maintenance mode, database operations, and production rollout under the
   responsible owner's authority.
6. Re-check every site or tenant independently; one updated environment is not
   evidence that the fleet is remediated.

## How to verify the remediation

- Confirm the deployed version is `3.1.8.7` or later using approved inventory
  and, where available, `wp plugin get bricksforge --field=version`.
- Confirm the package came from the vendor-supported source and matches the
  reviewed release artifact.
- Exercise legitimate Pro Forms registration behavior with an ordinary
  least-privileged test account. Do not add unexpected field identifiers or
  attempt administrator creation.
- Run the existing WordPress, form, authentication, authorization, and
  deployment smoke tests.
- Confirm the desired plugin version is present in the built artifact and every
  deployed site after caches and immutable images are refreshed.
- Record the version, artifact identity, environment, verifier, timestamp, and
  test results in the review evidence.

When the affected form was publicly reachable, review administrator accounts
through an approved channel. WP-CLI supports a read-only inventory such as:

```bash
wp user list --role=administrator \
  --fields=ID,user_login,user_email,user_registered \
  --format=csv
```

This administrator review is prudent post-exposure hygiene inferred from the
documented impact; it is not a vendor-prescribed remediation step. Treat an
unexpected administrator as an incident-response signal. Patching the plugin
does not remove an account that may already have been created.

## Rollback and stop conditions

Rollback means restoring the recorded prior deployment artifact and
configuration through the site's approved recovery path if the vendor-fixed
release causes an operational regression. Because rollback may restore a
vulnerable plugin, reapply the approved temporary containment and escalate the
blocked upgrade immediately.

Stop and write `TRIAGE.md` when:

- the installed version, plugin identity, or public form configuration cannot
  be established;
- the vendor package or integrity evidence is unavailable;
- repository ownership differs from live-site authority;
- the upgrade requires an unapproved production, database, or availability
  change;
- an unexpected administrator, suspicious registration, or other compromise
  indicator is found; or
- verification would require an exploit-like request.

The triage record must name CVE-2026-14956, the inspected scope, confirmed
facts, missing evidence, containment state, responsible owner, and safest next
action.

## Output contract

Return exactly one reviewer-ready change set scoped to CVE-2026-14956, or a
`TRIAGE.md` blocker record. A change set must include:

- affected-site and public-form exposure evidence;
- vendor-source and fixed-version evidence;
- the minimal repository diff;
- safe functional and security regression results;
- deployed-version and artifact verification;
- administrator-review disposition when the exact exposure was public;
- rollback steps and temporary-containment expiry; and
- residual risk and authoritative source links.

Do not claim remediation from a desired-state version alone. Do not suppress
the finding until the fixed package is verified in every affected deployment.

## Primary references

- [CVE Program CNA record for CVE-2026-14956](https://cveawg.mitre.org/api/cve/CVE-2026-14956)
- [GitHub Advisory GHSA-3h83-c8w5-cccx](https://github.com/advisories/GHSA-3h83-c8w5-cccx)
- [Bricksforge version changelog](https://bricksforge.io/version-changelog/)
- [Bricksforge getting-started and Customer Dashboard guidance](https://docs.bricksforge.io/en/getting-started/)
- [Bricksforge Pro Forms actions documentation](https://docs.bricksforge.io/en/elements/pro-forms/)
- [WP-CLI `plugin get` documentation](https://developer.wordpress.org/cli/commands/plugin/get/)
- [WP-CLI `user list` documentation](https://developer.wordpress.org/cli/commands/user/list/)
- [NVD record for CVE-2026-14956](https://nvd.nist.gov/vuln/detail/CVE-2026-14956)

## Related recipes

- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})
- [Vulnerable Dependency Remediation]({{< relref "/security-remediation/vulnerable-dependencies" >}})
- [How to remediate vulnerabilities with AI agents]({{< relref "/security-remediation" >}})

description: Critical, unauthenticated Bricksforge privilege escalation (CVSS 9.8). Check public User Registration forms. Upgrade WordPress sites to Bricksforge 3.1.8.7 or later.

maturity: stable

title: CVE-2026-14956 — Bricksforge Pro Forms privilege escalation

severity: critical

quality: curated

recipe_kind: markdown-override

summary: The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.


product: Aspera Faspex 5

vendor: IBM

metric_type: Primary

severity: high

part: a

vendor: ibm

status: Analyzed

summary: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.

title: Ibm Aspera Faspex security vulnerability


summary: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.


vendor: Pegatron Corp.

version_type: custom

summary: Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.


summary: Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\SYSTEM`, security product bypass, credential theft, or complete system compromise.

title: Pegatron Corp. Tdelo64.Sys security vulnerability


default_status: affected

product: Red Hat Directory Server 11

vendor: Red Hat

product: Red Hat Directory Server 12

product: Red Hat Directory Server 13

product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 7

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 9

archetype: generic

vendor: redhat

part: o

summary: A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

title: Redhat Directory Server security vulnerability


product: AIX

product: PowerVM VIOS

product: vios

product: aix

summary: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow.


product: PowerVM Novalink

severity: low

summary: IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions.

title: Ibm Powervm Novalink security vulnerability


product: Aspera Desktop App

product: aspera

summary: IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.

title: Ibm Aspera security vulnerability


product: WebSphere Application Server

summary: IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

title: Ibm Websphere Application Server security vulnerability


product: WebSphere Application Server - Liberty

summary: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.


product: go-slug

vendor: HashiCorp

status: Awaiting Analysis

summary: HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

title: Hashicorp Go-Slug security vulnerability


product: Engineering Lifecycle Management

less_than_or_equal: ) Interim Fix 021

version: 7.0.3 ( Interim Fix 001

less_than_or_equal: ) Interim Fix 009

version: 7.1.0 ( Interim Fix 001

version: 7.2.0 and 7.2.0 Interim Fix 001

summary: IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.

title: Ibm Engineering Lifecycle Management security vulnerability


summary: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.


summary: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.


product: Picturall Quad Compact Mark II

vendor: Analog Way

summary: The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.


vendor: stellarwp

summary: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as that is when the unescaped twitter_message value is evaluated inside the JavaScript template literal.

title: Stellarwp Givewp – Donation Plugin And Fundraising Platform security vulnerability


product: Aspera Faspex 5

summary: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.