Critical WordPress Plugin Vulnerability Actively Exploited

Key Takeaways

• A critical vulnerability (CVE-2026-85097) in the Bricksforge WordPress plugin is being actively exploited.
• The flaw allows unauthenticated remote code execution with a CVSS score of 10.0.
• Bricksforge versions up to and including 3.1.8.9 are affected.
• Users must update to Bricksforge version 3.1.8.10 or later immediately.

Critical Bricksforge Plugin Flaw Under Active Attack

Cybersecurity researchers have identified active exploitation targeting a severe vulnerability in the Bricksforge WordPress plugin. This critical flaw enables attackers to upload and execute arbitrary PHP code on affected websites without requiring any authentication, posing a significant risk to web administrators.

Vulnerability Details and Exploitation

Designated as CVE-2026-85097, the vulnerability carries the highest possible CVSS score of 10.0, indicating its extreme severity and potential for complete system compromise. Security firm Patchstack first detected active exploitation attempts on October 7, 2026, at 21:47:17 UTC.

The security hole impacts Bricksforge plugin versions up to and including 3.1.8.9. The vendor has released version 3.1.8.10 as the patched release. Bricksforge is a popular add-on that extends the Bricks Builder with capabilities such as advanced forms, animations, dynamic data handling, and comprehensive site controls. The core of this attack vector lies within the plugin’s form upload process.

According to Patchstack’s technical report, the vulnerability originates from an insufficient validation mechanism during file uploads. Initially, Bricksforge conducts a MIME type check to verify if an uploaded file is an allowed image format. However, during a subsequent form submission, the plugin fails to adequately re-verify visitor-supplied file details, particularly the URL field within the temporaryFileUploads parameter.

Exploiters leverage this by first uploading a file disguised as a legitimate image (e.g., a GIF) but containing malicious PHP code. This file successfully bypasses the initial MIME type check and is placed in a temporary upload directory. A subsequent, specially crafted form submission then links the server path of this “image” to a destination URL that ends with a PHP extension (e.g., .php). Bricksforge processes these details, effectively moving the malicious file contents to a PHP-executable location. When this newly created PHP file is accessed, the server executes the embedded malicious code.

Impact and Attack Patterns

Successful exploitation allows attackers to install web shells, deface websites, exfiltrate sensitive data, or establish persistent backdoors. The attack also utilizes the publicly accessible bricksforge_regenerate_nonce AJAX action to acquire a valid request token, bypassing typical security measures.

This incident is distinct from a previous remote code execution vulnerability found in the Bricks Builder itself. It underscores a recurring risk observed in WordPress plugin ecosystems, where inadequately secured file upload functionalities can be weaponized into pathways for remote code execution.

Analysis of the exploitation attempts shows that nearly all attacks targeted the /wp-json/bricksforge/v1/form_submit endpoint, with one instance observed targeting /wp-admin/admin-ajax.php using the bricksforge_form_submit action. In approximately 95% of requests, the initial server path ended in .gif or .png, consistently paired with a PHP destination URL. Attackers experimented with various PHP extensions, including .php5, .php8, and .phtml, alongside mixed-case and encoded filenames. Some attempts also aimed to place login_admin_*.php files outside the temporary directory, directly into standard WordPress upload folders.

Patchstack recorded 63 unique source IP addresses involved in these attacks. One notable cluster involved 44 IPs issuing 56 identical requests within seconds, while another consisted of three IPs testing 25 different extension and encoding variations. These patterns suggest an automated, distributed attack infrastructure, though they do not definitively identify a single attacker.

What You Should Do

• Update Immediately: All administrators running affected Bricksforge installations must update to version 3.1.8.10 or later without delay. The vendor changelog also notes a “Pro Forms upload security fix” in version 4.0.1, released October 8, and recommends updating even if no active forms use upload fields.
• Review Logs: Scrutinize your web server and WordPress logs for any suspicious activity, specifically looking for crafted temporaryFileUploads submissions.
• Inspect Upload Directories: Check /wp-content/uploads/bricksforge/tmp/ and other WordPress upload directories for any unexpected or newly created PHP files.
• Monitor for Unauthorized Activity: Look for requests to newly created scripts or any unauthorized modifications to your website content or configuration.
• Implement Mitigation: If immediate updates are not feasible, Patchstack states its RapidMitigate rule provides temporary protection against exploitation attempts. However, this should not replace a full update.
• Perform Compromise Review: Websites that were exposed to the vulnerability before patching should undergo a thorough security review to ensure no compromise occurred.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.