Decryption key:
Bricksforge - The Bricks Tools That Feel Native v3.1.8.8 Nulled
= 3.1.8.8
31. July 2026
Fixed an unauthenticated arbitrary password reset in the Pro Forms "Reset User Password" action
A published Pro Form using the Reset User Password action in Update mode could be used by an unauthenticated visitor to set the password of any account. The action now verifies ownership: a logged-in user changing their own password, a valid WordPress reset key, an account created by the same submission, or a user the visitor is allowed to edit. Reported by moonge via WPScan.
fix
[Pro Forms] Hardened the user and post actions against anonymous misuse
Update User, Update User Meta and Update/Delete Post now require that the submission owns the target (or that the site owner explicitly scoped the post type), instead of trusting an ID or email taken from a form field.
fix
[API Query Builder] Loading conditions now apply on archive pages (WooCommerce shop, CPT/date archives, search, 404)
fix
[Pro Forms] Fixed an "Undefined array key submitButtonConditionsRelation" warning on submit button conditions
fix
[Pro Forms] bricksforge_send_mail() now runs inside Custom Actions (REST requests)
fi
[General] External Files CSS: element styles are no longer lost when a post is saved outside the builder
More:
https://forum.bricksforge.io/t/pro-forms-css-not-rendering-with-external-file-css-rendering/5195
fix
[Split Text] Restored word wrapping and overflow clip/reveal after the GSAP SplitText 3.15 update; property-less Lines actions run again
More:
https://forum.bricksforge.io/t/spli...ds-to-break-unexpectedly-version-3-1-8-6/5103
fix
[General] Fixed BRFPANEL being localised twice on the frontend (removed a duplicated ~107 KB inline payload)
More:
https://forum.bricksforge.io/t/brfp...load-duplicated-in-frontend-html-3-1-8-7/5204