Attackers Have Exploited Bricksforge WordPress Plugin Flaw Since Oct. 7, Patch Available

Attackers have been exploiting the Bricksforge plugin for WordPress since October 7. The flaw is tracked as CVE-2026-85097, and it lets an attacker with no login upload a file and run their own PHP code on the web server.

Patchstack, the WordPress security firm that disclosed it, says its telemetry first caught exploitation attempts on October 7, 2026, at 21:47 UTC. That is 5:47 p.m. Eastern. Patchstack's disclosure came on October 8.

All Bricksforge versions up to and including 3.1.8.9 are vulnerable. Version 3.1.8.10 fixes the problem.

What the bug does

Bricksforge is an add-on for Bricks, a visual site builder for WordPress. It handles advanced forms, animations and scrolling video sequences.

The plugin checks a file's MIME type when the file is first uploaded. When the form is later submitted, it trusts the file metadata the browser sends back. It does not validate the `url` field inside the `temporaryFileUploads` parameter.

That gap is the whole attack. Wordfence's advisory lays out the path:

• An attacker first gets a valid nonce from the `bricksforge_regenerate_nonce` AJAX endpoint.
• The attacker uploads a GIF/PHP polyglot file, a file that is both a valid image and valid PHP, to the temporary upload directory. The upload passes the MIME check.
• The attacker then submits a form where the server-side file path points to the harmless GIF, but the `url` field ends in `.php`.
• The server then makes it possible for the attacker to upload and execute arbitrary PHP code.

From there, Patchstack says, an attacker can deploy web shells, modify site content, read sensitive data and establish persistent access.

What the attacks look like

Patchstack says all but one of the observed attempts hit the REST endpoint `/wp-json/bricksforge/v1/form_submit`. The remaining request hit `/wp-admin/admin-ajax.php` with the `bricksforge_form_submit` action. Every request carried a crafted `temporaryFileUploads` parameter.

The activity is automated. Patchstack logged 63 unique source IP addresses, and the six most active accounted for about 46% of all requests. In one cluster, 44 IPs sent 56 identical requests within seconds. In another, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file. Patchstack says both patterns point to automated exploitation over rotating proxies or distributed infrastructure, and that they do not on their own attribute the activity to a single threat actor.

Some requests cycled through alternate PHP extensions such as `.php5`, `.php7` and `.phtml`, along with mixed-case and URL-encoded variants, to slip past extension filters. Automated campaigns like this go after every site they can find, not just high-profile ones.

Severity scores don't match

Patchstack and The Hacker News list the flaw at CVSS 10.0, the maximum. The CVE record, published October 8, lists it at 9.8 under CVSS 3.1, with the vector showing network access, low complexity, no privileges and no user interaction. The NVD analysis is pending, and its status is listed as "Deferred."

The difference between 10.0 and 9.8 changes nothing for site owners. Both are critical, and exploitation is confirmed.

The EPSS system, which estimates the chance of exploitation in the next 30 days, put CVE-2026-85097 at 0.31%, at the 22.1th percentile.

Not the plugin's first problem

A WPScan lookup cited by the Carthage Electronics security blog shows earlier Bricksforge issues fixed in versions up to 3.1.8.8. They include unauthenticated privilege escalation and password reset.

What site owners should do

The fix is simple. Update Bricksforge to 3.1.8.10 or later.

Patchstack says that if a site ran a vulnerable version without protection, administrators should review historical logs and the host itself for unexpected PHP files, unusual application activity and unauthorized changes. Patchstack says it has deployed a mitigation rule for its own users. Administrators should also look for stray PHP files in the temporary upload directory, `/wp-content/uploads/bricksforge/tmp/`. Some payloads aimed further, using destination filenames matching `login_admin_*.php` to place PHP files in the regular WordPress uploads directory. Security practitioners also recommend blocking `form_submit` requests that contain `temporaryFileUploads` at the web application firewall.

A compromised server can mean defaced pages, SEO spam, stolen form submissions and a foothold on anything else that host can reach.

A separate WordPress alert

Bricksforge is not the only recent WordPress emergency. WordPress released version 7.1.2 on September 22, 2026, to close a separate Core flaw, CVE-2026-87902. It affects releases from 4.7.0 through 7.1.1 and carries a CVSS 4.0 score of 9.2.

The bug lets an unauthenticated attacker make page-template resolution include a readable local PHP file outside the active theme's directories. Remote code execution depends on extra conditions. The theme needs a top-level directory beginning with `page-`, and the server needs a usable readable PHP file. Researcher Robert Ressl demonstrated the attack using PEAR's `pearcmd.php` on a server with PHP's `register_argc_argv` setting on. WordPress has backported fixes to maintained branches as far back as 4.7.

What is still unknown

The number of compromised sites and the number of active Bricksforge installs are not stated in the sources. Wordfence's advisory and the CVE record are the references to watch for scoring updates once NVD completes its analysis.