A theme runs code too, the story of the Bricks Builder flaw
When we think about WordPress flaws, we usually mean plugins. But a theme is also a program that runs code. And if it has a bug, it can be just as dangerous. Bricks Builder showed this painfully.
What happened
Bricks is a popular, paid site builder (theme) for WordPress. In early 2024 a flaw was found in it, CVE-2024-25600, rated 9.8/10, that allowed remote execution of arbitrary code on the server without logging in.
The worst part: the first real attacks appeared within a day of the patch being released. Attackers do not wait; as soon as a flaw is public, bots start scanning the internet for unpatched sites.
Why it matters
Remote code execution (RCE) is the top of the threat list, a stranger gains the ability to do whatever they want on the server. And it does not matter whether the "hole" is in the core, a plugin or a theme. Only one thing counts: was the site updated before the attack started.
What to do
- Update the theme as urgently as plugins and the core, it is not "just the look".
- Buy themes and builders from a legitimate source, so you actually receive updates at all.
- After a critical flaw is disclosed, count time in hours, not days.
In practice hardly anyone follows the security bulletins for their theme. That is why we do it for our clients, we monitor vulnerabilities in the core, plugins and themes and update before an attacker does.
Source: NVD, CVE-2024-25600.