Critical Bricksforge WordPress Flaw Under Active Exploitation

Patchstack has reported active exploitation of a critical flaw in the Bricksforge plugin for WordPress. The vulnerability, CVE-2026-85097, carries the highest possible severity rating — CVSS 10.0 — and lets unauthenticated attackers upload and execute arbitrary PHP code, resulting in remote code execution (RCE).

Bricksforge bills itself as a "Swiss Army knife" for Bricks, a visual website builder for WordPress, offering animations, advanced forms, and scrolling video sequences. Versions up to and including 3.1.8.9 are affected; a fix shipped in 3.1.8.10, and users are urged to move to the current 4.0.1.

How the flaw works

When a file is first uploaded, the plugin correctly validates its MIME type. But when a form is later submitted, it blindly trusts the metadata sent by the client — in particular, it never checks the url field inside the temporaryFileUploads parameter.

The attack unfolds in four steps. First the attacker requests a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint. Next they upload a polyglot — a file that is both a valid GIF image and carries PHP code; it passes the MIME check and lands in the temporary directory. Then they submit a form whose file field points to the validated image but whose url field ends in a .php extension. The plugin trusts that metadata and writes the file's contents to the PHP path — and the embedded code runs when that file is requested.

Successful exploitation hands the attacker full control of the site: deploying web shells, reading sensitive data, and establishing persistent access.

Signs of attack

Patchstack detected the first exploitation attempts on October 7, 2026, at 9:47 p.m. UTC. The activity came from 63 unique IP addresses, six of which accounted for roughly 46% of all requests. To dodge extension filtering, attackers rely on alternate extensions (.php5, .php7, .phtml), case manipulation (.PHP, .pHp), and encoded variants. One cluster of 44 addresses fired 56 identical requests within seconds; another tested 25 extension and encoding variations against a single file — hallmarks of automated attacks over rotating proxies.

Site owners are advised to audit requests to the /wp-json/bricksforge/v1/form_submit endpoint carrying a temporaryFileUploads parameter, watch for repeated form submissions, and look for unexpected PHP files in /wp-content/uploads/bricksforge/tmp/.

Per Wordfence, 2,073 WordPress-related vulnerabilities were published in the second quarter of 2026, and about 573,000 sites were compromised — so Bricksforge is just one piece of a much larger picture.

Source: The Hacker News