CYBER CODE RED

Get real-time updates on Telegram

VULNERABILITYEditorialPatchstackThe Hacker NewsSecurityWeek+1 sources

Bricksforge plugin for WordPress exploited in the wild through CVE-2026-85097, an unauthenticated file upload flaw in versions up to 3.1.8.9

A maximum-severity vulnerability in the Bricksforge plugin for WordPress, tracked as CVE-2026-85097, is being exploited in the wild, according to Patchstack. Bricksforge is a commercial add-on for the Bricks visual site builder; Patchstack told SecurityWeek that roughly 6,000 websites use it. The flaw affects Bricksforge versions up to and including 3.1.8.9 and is fixed in version 3.1.8.10. Patchstack rates it CVSS 10.0, and the CVSS 3.1 base score in the NVD record is 9.8. No login is required to exploit it.

Patchstack says Bricksforge validates a file's MIME type when it is first uploaded, but on form submission it trusts the file metadata the client sends and does not validate the 'url' field inside the 'temporaryFileUploads' parameter. An unauthenticated attacker can request a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot that passes the image check, then submit a form whose file path points to that image while its url ends in a PHP extension; the plugin writes the file's contents to the PHP location, and requesting that file executes the embedded code. SecurityWeek reports this can let an attacker take full control of a targeted WordPress website, and Patchstack says the result can include web shells, modified site content, reading sensitive data and persistent access.

Patchstack's telemetry shows exploitation attempts beginning on 7 October 2026 at 21:47 UTC, directed at the /wp-json/bricksforge/v1/form_submit endpoint or at admin-ajax.php with the bricksforge_form_submit action, using alternative PHP extensions (.php5, .php7, .phtml), altered capitalisation and encoded extensions to get around filtering. The activity was recorded from 63 unique source IPs; Patchstack says the two clusters it observed point to automated exploitation over rotating proxies or distributed infrastructure and do not on their own attribute the activity to a single threat actor. Patchstack and SecurityWeek advise updating to Bricksforge 3.1.8.10 or later, and Patchstack notes that updating does not remove files an attacker already planted, listing indicators that include unexpected PHP files in /wp-content/uploads/bricksforge/tmp/ and files named login_admin_*.php.

Published 12-Oct-2026 00:00 UTC · First seen 12-Oct-2026 00:00 UTC

Sources