Bricksforge (CVE-2026-85097): Critical WordPress Plugin Flaw Is Under Attack

The Bricksforge WordPress plugin has a critical flaw, CVE-2026-85097, that lets anyone upload a PHP file without logging in and run code on the server. Patchstack has seen attacks since October 7, 2026. Versions 3.1.8.9 and older are affected, and the fix is in 3.1.8.10. According to SecurityWeek, about 6,000 sites use the plugin. If you use it, update today, then check whether anyone got in.

What the flaw is

The Pro version of Bricksforge has forms with file upload. Patchstack describes the bug like this: the plugin checks the file's MIME type only when the file is first uploaded. When the form is submitted, it trusts the metadata sent by the browser, and it does not validate the url field inside the temporaryFileUploads parameter.

The attack has three steps:

1. The attacker uploads a file that is a valid GIF image and also contains PHP code (a polyglot). It passes the type check.
2. They submit a form where the file path points to the image, but the url field ends in a PHP extension.
3. The server writes the file contents under a PHP name. When the attacker opens that file in a browser, the code runs.

The attack goes through POST /wp-json/bricksforge/v1/form_submit or through admin-ajax.php with the action bricksforge_form_submit. The nonce it needs comes from the public bricksforge_regenerate_nonce action, so no account is needed. The result is a web shell: changed site content, stolen data, lasting access.

Severity and attack scale

• CVSS: Patchstack gives 10.0. SecurityWeek mentions 9.8. Either way it is critical.
• First observed attack: October 7, 2026, 21:47 UTC.
• Attack sources: 63 unique IP addresses. One cluster of 44 addresses sent 56 identical requests within seconds. A second cluster of 3 addresses tested 25 variations of PHP extensions against the same temporary file. This looks like automated attacks through rotating proxies, not a single actor.

What to do now

1. Update Bricksforge to 3.1.8.10 or newer. This is the only full fix. If you cannot update, deactivate the plugin until you can.
2. Review your logs from October 7. Look for requests to /wp-json/bricksforge/v1/form_submit with temporaryFileUploads, calls to bricksforge_regenerate_nonce right before an upload, and repeated submissions that change the extension, encoding or letter case.
3. Look for suspicious files. Check wp-content/uploads/bricksforge/tmp/ and other folders in uploads (for example uploads/2026/10/) for PHP files. Patchstack lists names like login_admin_*.php and variants such as .php5, .php7, .php8, .phtml, .pht, .phps, mixed case and encoded forms like %2ephp. There should be no PHP files in uploads at all.
4. Check IP addresses in your logs. The most active sources according to Patchstack: 177.75.57.20, 23.97.62.146, 84.247.60.125, 38.154.185.97, 150.109.16.166, 153.75.90.146.
5. Check accounts and changes. New administrators, new cron jobs, changed theme and plugin files, unknown redirects.

If you find a web shell, do not stop at deleting it. Change passwords and keys (wp-config.php, database, FTP), review all files and keep the logs. It is also worth reading about infections that rebuild themselves after cleanup: The "SC" WordPress Backdoor.

The lesson: plugins can be critical too

This case is different from our posts about WordPress core, such as WordPress 7.1. WordPress core gets automatic security updates, and plugins usually do not. A flaw in a plugin used by a few thousand sites becomes a target for automated scanners right away. The same mistake, trusting data from the browser during file upload, shows up in many plugins. So remove plugins you do not use, and turn on automatic updates for the ones you do use where that is safe.

Sources

• Patchstack: Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
• SecurityWeek: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
• The Hacker News: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw