Attackers Actively Exploit Critical Bricksforge WordPress Plugin Flaw for Remote Code Execution
Patchstack reports active wild exploitation of CVE-2026-85097, a maximum-severity flaw in Bricksforge allowing unauthenticated remote code execution on WordPress sites.
Key points
- CVE-2026-85097 allows unauthenticated attackers to execute arbitrary PHP code on vulnerable WordPress sites.
- Patchstack detected active exploitation of the flaw in the Bricksforge plugin on October 7, 2026.
- The vulnerability affects Bricksforge versions up to and including 3.1.8.9, with a patch available in 3.1.8.10.
Security researchers at Patchstack confirmed that attackers are actively exploiting a critical vulnerability in the Bricksforge WordPress plugin. The flaw, identified as CVE-2026-85097, carries a maximum CVSS score of 10.0 and enables unauthenticated remote code execution on affected websites.
The vulnerability allows attackers to upload and execute arbitrary PHP code without needing valid login credentials. Patchstack reported detecting these exploitation efforts on October 7, 2026, at 9:47 p.m. UTC. The issue impacts all versions of the Bricksforge plugin up to and including version 3.1.8.9. Developers have released a fix in version 3.1.8.10.
Technical Details of the Exploit
The flaw stems from insufficient validation of URL fields during form submission processes. According to Patchstack, the plugin correctly validates file MIME types upon initial upload but fails to verify the 'url' field within the 'temporaryFileUploads' parameter later. This discrepancy allows attackers to bypass security checks and manipulate file handling.
Wordfence described the exploitation process in an advisory, noting it involves four distinct steps. Attackers first request a valid nonce from an unauthenticated AJAX endpoint. They then upload a GIF/PHP polyglot file, which passes initial MIME checks and lands in a temporary directory. Subsequently, the attacker submits a form pointing to this validated image but assigns a PHP extension to the URL field. The plugin trusts this metadata, moving the file to a PHP location where the embedded code executes.
Affected Software and Context
Bricksforge is marketed as a comprehensive toolkit for the Bricks visual website-building tool for WordPress. The plugin supports advanced features such as animations, complex forms, and scrolling video sequences. Because the vulnerability allows for unauthenticated access, any public-facing WordPress site using a vulnerable version of Bricksforge is potentially at risk.
The maximum severity rating reflects the ease with which attackers can gain full control over the server. Remote code execution vulnerabilities are among the most dangerous flaws in web applications, as they can lead to data theft, site defacement, or the installation of additional malware. The active exploitation reported by Patchstack indicates that threat actors are already targeting sites with this specific plugin.
What should you do?
Site administrators should immediately verify the version of the Bricksforge plugin installed on their WordPress installations. If the version is 3.1.8.9 or earlier, updating to version 3.1.8.10 is necessary to mitigate the risk. Users should also monitor server logs for unusual activity or unauthorized file uploads, particularly in temporary directories.
What to do and how to stay safe: Bricksforge
- Check your WordPress plugin list to identify if Bricksforge is installed and determine its current version number.
- Update the Bricksforge plugin to version 3.1.8.10 or later if you are running a vulnerable version.
- Review server access logs for suspicious requests to the 'bricksforge_regenerate_nonce' endpoint or unusual file uploads.
- Implement web application firewalls to block known exploit patterns targeting this specific vulnerability until updates are applied.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-85097?
CVE-2026-85097 is a critical security flaw in the Bricksforge WordPress plugin that allows unauthenticated attackers to execute arbitrary PHP code, resulting in remote code execution.
Which versions of Bricksforge are affected?
The vulnerability affects all versions of the Bricksforge plugin up to and including version 3.1.8.9.
Is there a fix available for this vulnerability?
Yes, a patch has been released in Bricksforge version 3.1.8.10, which addresses the security flaw.
