CVE-2024–25600: WordPress Bricks Builder Remote Code Execution Vulnerability -$$$$ BOUNTY

The CVE-2024–25600 vulnerability is a high-severity flaw in the Bricks Builder plugin for WordPress, disclosed on February 26, 2024. It allows unauthenticated remote code execution (RCE), permitting attackers to execute malicious code on affected servers without needing authentication. With a CVSS score of 9.8, this vulnerability is highly critical.

The issue arises from the improper use of the eval function in PHP code within the Bricks Builder plugin. This flaw allows attackers to craft malicious payloads that can be executed remotely, potentially leading to full server compromise. Affected versions include Bricks Builder up to 1.9.6.