A critical security vulnerability in the Bricksforge plugin for WordPress is being actively exploited, allowing attackers to upload malicious files and execute PHP code on vulnerable websites without authentication. The flaw, tracked as CVE-2026-85097, has a CVSS severity score of 10.0, the highest possible rating.
According to WordPress security company Patchstack, it detected exploitation attempts on October 7, 2026. The vulnerability affects Bricksforge versions up to and including 3.1.8.9. Site administrators should update the plugin immediately to a patched release.
Bricksforge is an add-on for Bricks, a visual website builder for WordPress. It offers features such as advanced forms, animations, and scrolling video sequences. The vulnerability is particularly serious because attackers do not need a user account or login credentials to exploit it.
The flaw stems from how Bricksforge handles temporary file uploads during form submissions. The plugin checks a file’s MIME type when it is uploaded, but it does not properly validate the URL supplied later through the temporaryFileUploads parameter.
An attacker can take advantage of this gap by uploading a file that looks like a valid GIF or PNG image but also contains PHP code. The file passes the initial MIME-type check and is stored in the plugin’s temporary upload directory.
The attacker then submits a form with manipulated file metadata. While the file path points to the uploaded image, the accompanying URL points to a PHP file. Bricksforge trusts the supplied URL and can place the uploaded content at that PHP location. When the server processes the resulting file, the embedded code can execute.
Wordfence described a similar attack sequence in its advisory. The process begins with an attacker obtaining a valid nonce through Bricksforge’s bricksforge_regenerate_nonce AJAX endpoint. The attacker then uploads a specially crafted file and submits a form containing the manipulated temporaryFileUploads parameter.
Attackers are targeting the plugin’s REST API form submission endpoint, /wp-json/bricksforge/v1/form_submit, as well as the WordPress AJAX endpoint with the bricksforge_form_submit action. They have also attempted to bypass extension filters by using alternatives such as .php5, .php7 and .phtml, changing the capitalization of file extensions, and encoding parts of the extension.
Successful exploitation could give attackers the ability to execute arbitrary PHP code on the server. Depending on the access they obtain, they could take control of a website, install web shells, steal sensitive information, or maintain access even after the initial attack.
Patchstack recorded activity from 63 unique source IP addresses. Its telemetry revealed two notable clusters of requests. In one cluster, 44 IP addresses sent 56 requests with identical payloads within seconds. In another, three IP addresses tested 25 variations of PHP extensions and encodings against the same temporary file.
The patterns suggest automated exploitation using rotating proxies or distributed infrastructure. However, Patchstack cautioned that the activity does not establish that all the requests came from a single threat actor.
Patchstack identified six IP addresses that accounted for roughly 46% of the observed requests:
177.75.57[.]2023.97.62[.]14684.247.60[.]12538.154.185[.]97150.109.16[.]166153.75.90[.]146
Website owners running Bricksforge should install a fixed version as soon as possible. They should also review requests to the form submission endpoints, look for repeated or unusual submissions containing temporaryFileUploads, and check the /wp-content/uploads/bricksforge/tmp/ directory for unexpected PHP files.
The supplied security information identifies version 3.1.8.10 as the patch for the affected release line, while the latest version cited in the advisory is 4.0.1. Administrators should install the latest compatible patched release available from the plugin’s official source rather than relying on an older fixed version.
Related Posts
