Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code.
It is tracked as CVE-2026-85097 and has a CVSS score of 10.0, affecting versions up to 3.1.8.9. Administrators are advised to upgrade to version 3.1.8.10 or later.
Patchstack disclosed this issue on October 8, 2026, reporting that exploitation attempts began on October 7 at 21:47:17 UTC.
Bricksforge enhances Bricks Builder by offering advanced forms, animations, dynamic data management, and customization features. The vulnerability involves temporary file uploads processed during form submissions.
Critical WordPress Bricksforge Flaw
The vulnerability arises from inconsistent validation between file uploads and subsequent form submissions. Bricksforge initially checks the MIME type of the uploaded file. However, later trusts client-supplied metadata, including the URL field within the `temporaryFileUploads` parameter.
Attackers can obtain a valid nonce through the unauthenticated `bricksforge_regenerate_nonce` AJAX endpoint. They then upload a GIF/PHP polyglot, a file that contains both valid image data and embedded PHP code. This file passes the initial MIME validation and is stored in the temporary uploads directory.
During form submission, attackers provide metadata that links to the validated image while specifying a destination URL ending in a PHP extension.
Bricksforge then places the file contents at that specified location. When an attacker requests the resulting PHP file, it executes the embedded code, potentially enabling web shells, data theft, content modification, and persistent access.
Nearly every observed attack targeted the `POST /wp-json/bricksforge/v1/form_submit` endpoint. One request used `/wp-admin/admin-ajax.php` with the `bricksforge_form_submit` action instead. All captured requests contained crafted `temporaryFileUploads` metadata.
In 95% of the captured requests, the server-side file path ended in .gif or .png, with most pairing these paths with a PHP-related destination URL.
Attackers tested alternative extensions, mixed capitalization, URL encoding, double encoding, and modified metadata fields to probe the validation process. Some payloads used filenames like `login_admin_*.php` in standard WordPress upload directories.
Patchstack recorded 63 unique source IP addresses, with six accounting for about 46% of requests. One cluster involved 44 IPs sending 56 identical requests within seconds; another cluster saw three IPs attempting 25 variations of extensions and encoding. These patterns suggest automated, distributed exploitation but do not confirm attribution to a specific threat actor.
Administrators should install Bricksforge version 3.1.8.10 or later immediately. For environments unable to update quickly, Patchstack also offers a RapidMitigate traffic-layer rule.
Investigators should review logs for suspicious form submissions, image-to-PHP metadata mismatches, nonce requests followed by file uploads, and requests to newly created PHP files.
Additionally, they should examine `/wp-content/uploads/bricksforge/tmp/` and other upload directories for any unexpected scripts, particularly those named `login_admin_*.php`. Past installations should also undergo historical log reviews and checks for unauthorized changes.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
