Bricksforge WordPress plugin flaw exploited for RCE (CVE-2026-85097)

A critical Bricksforge vulnerability, tracked as CVE-2026-85097, is being exploited against WordPress sites. According to Patchstack, it lets an unauthenticated attacker upload and run arbitrary PHP code, which means full remote code execution (RCE) on the web server. Versions up to and including 3.1.8.9 are affected, and the fix is in version 3.1.8.10.

Patchstack, as reported by The Hacker News, says it saw exploitation attempts on October 7, 2026 at 9:47 p.m. UTC. The flaw is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalogue in the data we reviewed, so no KEV due date applies.

What happened

Bricksforge is a WordPress plugin that extends the Bricks visual site builder with animations, advanced forms and similar features. The bug sits in its form handling. When a file is first uploaded, the plugin checks its MIME type correctly. When the form is submitted later, however, it trusts the file metadata sent by the client. In particular, it does not validate the url field inside the temporaryFileUploads parameter.

An attacker can abuse that gap in four steps:

1. Request a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint.
2. Upload a GIF/PHP polyglot, a file that is a valid image but also contains PHP code. It passes the MIME check and lands in the temporary upload directory.
3. Submit a form where the file path points at that validated image, but the url value ends in a PHP extension.
4. The plugin places the file contents at the PHP location, and the embedded code runs when that file is requested.

Am I affected by the Bricksforge flaw?

• Affected: Bricksforge for WordPress, versions up to and including 3.1.8.9.
• Fixed: version 3.1.8.10.
• Other products: none named in the sources. The NVD record does not list structured affected-version data.

Any site running the plugin at or below 3.1.8.9 should be treated as exposed, because no login is needed.

Technical details

• Weakness: CWE-434, unrestricted upload of a dangerous file type.
• Attack vector: network, low complexity, no privileges and no user interaction (NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
• Severity scores conflict: NVD lists a CVSS base score of 9.8, while The Hacker News reports 10.0. Both are critical, and we have not confirmed which one the vendor or CNA assigned.
• EPSS: 0.00312, a low modelled probability of exploitation. That figure predates or ignores the in-the-wild activity Patchstack reports, so do not use it to downgrade urgency.
• KEV status: not listed in the data we reviewed.

Why this matters

Analysis, not new facts. Unauthenticated file-upload-to-code-execution bugs in popular WordPress plugins are cheap to automate, and exploitation has been seen within days of the CVE being published on October 8, 2026. A compromised site can be used to deploy web shells, read sensitive data and keep persistent access, as the reporting notes. On shared hosting or a server that hosts several sites, one vulnerable plugin can become a foothold for the rest. If you run Bricksforge on a public site, treat the patch as same-day work even without a KEV entry.

Indicators and detection

Patchstack reports that attackers targeted these endpoints, with a crafted temporaryFileUploads parameter:

• The REST route /wp-json/bricksforge/v1/form_submit
• The /wp-admin/admin-ajax.php endpoint with the bricksforge_form_submit action

Specific attacker IP addresses and file hashes have not been disclosed in the material we reviewed. Hunting ideas that follow from the facts:

• Search web server and WAF logs from October 7, 2026 onward for requests to the two endpoints above, and for calls to bricksforge_regenerate_nonce from clients that never loaded a page.
• Look for POST bodies containing temporaryFileUploads where the url value ends in .php.
• Check the WordPress uploads and Bricksforge temporary directories for new .php files, or image files that contain PHP tags.
• Review recently created admin users and modified plugin or theme files.

What to do: fix Bricksforge CVE-2026-85097

1. Update Bricksforge to 3.1.8.10 or later on every site you manage, including staging copies that are reachable from the internet.
2. If you cannot update immediately, deactivate the plugin until you can. No other workaround is named in the sources.
3. Hunt for compromise using the checks above, covering the period since October 7, 2026. If you find an unexpected PHP file, assume code ran: isolate the site, remove the file, rotate WordPress, database and hosting credentials, and restore from a known-good backup if needed.
4. Tell the site owners and hosting teams involved, and record the plugin version across your inventory so unpatched copies are found quickly.

Further detail is in the vendor changelog and the Wordfence advisory linked below.

Sources

• NVD: CVE-2026-85097
• Bricksforge version changelog
• Wordfence advisory for the Bricksforge vulnerability
• The Hacker News: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw