Bricksforge and Bricks Builder: WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code

Critical Zero-Day Exploit Targets Bricksforge WordPress Plugin (CVE-2026-85097)

Attackers are actively exploiting a severe vulnerability in the Bricksforge WordPress plugin, tracked as CVE-2026-85097, allowing unauthenticated remote code execution (RCE). The flaw, assigned a CVSS score of 10.0, enables threat actors to upload and execute arbitrary PHP code on affected websites without requiring login credentials.

The vulnerability impacts Bricksforge versions up to and including 3.1.8.9, with the fixed release (3.1.8.10) issued to address the issue. Bricksforge, an extension for Bricks Builder, enhances WordPress sites with advanced forms, animations, and dynamic data tools its file upload functionality is the primary attack vector.

Exploitation Mechanics

According to Patchstack’s technical analysis, the flaw stems from insufficient validation in the plugin’s form upload process. While Bricksforge initially checks a file’s MIME type to verify it as an allowed image (e.g., GIF/PNG), it later trusts user-supplied file details without revalidating the URL field in temporaryFileUploads. Attackers bypass security by:

1. Uploading a file disguised as an image (e.g., a GIF with embedded PHP code).
2. Submitting a crafted form that pairs the image’s server path with a malicious PHP destination URL.
3. Triggering code execution when the server processes the file.

Once exploited, attackers can deploy web shells, alter website content, exfiltrate sensitive data, or maintain persistent access. The attack also leverages the bricksforge_regenerate_nonce AJAX action to obtain valid request tokens.

Attack Patterns & Observations

Patchstack detected exploitation attempts beginning October 7, 2026 (21:47:17 UTC), with nearly all requests targeting:

• /wp-json/bricksforge/v1/form_submit (primary endpoint).
• /wp-admin/admin-ajax.php (via bricksforge_form_submit action).

Key findings include:

• 95% of requests used .gif or .png extensions in the server path, paired with PHP destination URLs (e.g., .php5, .php8, .phtml).
• Attackers tested mixed capitalization, encoded filenames, and attempts to place malicious files (e.g., login_admin_*.php) outside temporary directories.
• 63 unique source IPs were recorded, with automated, distributed activity including one cluster of 44 IPs sending 56 identical requests within seconds and another testing 25 extension/encoding variations.

Vendor Response & Mitigation

Bricksforge released version 3.1.8.10 to patch the flaw, with an additional security fix for Pro Forms uploads in version 4.0.1 (October 8, 2026). Administrators are urged to:

• Update immediately to the latest version, even if active forms lack upload fields.
• Review logs for suspicious temporaryFileUploads submissions.
• Inspect upload directories (e.g., /wp-content/uploads/bricksforge/tmp/) for unexpected PHP files.
• Monitor for unauthorized script execution or website changes.

Patchstack’s RapidMitigate rule provides temporary protection for sites unable to update immediately, though a compromise review is recommended for previously exposed installations. This incident underscores the risks of unsafe file handling in WordPress plugins, where upload features can be weaponized for RCE.

Source: https://cybersecuritynews.com/wordpress-plugin-vulnerability-exploited/

WP Security Ninja cybersecurity rating report: https://www.rankiteo.com/company/wp-security-ninja

Bricks Builder cybersecurity rating report: https://www.rankiteo.com/company/bricks-builder

"id": "WP-BRI1791865446",
"linkid": "wp-security-ninja, bricks-builder",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Websites using Bricksforge '
                                              'plugin (versions ≤ 3.1.8.9)',
                        'industry': 'Web Development/WordPress',
                        'name': 'Bricksforge',
                        'type': 'WordPress Plugin'}],
 'attack_vector': 'File upload functionality in Bricksforge WordPress plugin',
 'customer_advisories': 'Administrators urged to update immediately and review '
                        'for compromise',
 'data_breach': {'data_exfiltration': 'Possible',
                 'file_types_exposed': ['PHP', 'GIF', 'PNG'],
                 'sensitivity_of_data': 'High (arbitrary code execution, data '
                                        'exfiltration)',
                 'type_of_data_compromised': 'Sensitive website data, PHP code '
                                             'execution'},
 'date_detected': '2026-10-07T21:47:17Z',
 'description': 'Attackers are actively exploiting a severe vulnerability in '
                'the Bricksforge WordPress plugin, tracked as CVE-2026-85097, '
                'allowing unauthenticated remote code execution (RCE). The '
                'flaw enables threat actors to upload and execute arbitrary '
                'PHP code on affected websites without requiring login '
                'credentials. The vulnerability impacts Bricksforge versions '
                'up to and including 3.1.8.9, with the fixed release '
                '(3.1.8.10) issued to address the issue.',
 'impact': {'data_compromised': 'Sensitive data exfiltration possible',
            'operational_impact': 'Unauthorized code execution, website '
                                  'content alteration, persistent access',
            'systems_affected': 'WordPress websites using Bricksforge plugin '
                                '(versions ≤ 3.1.8.9)'},
 'investigation_status': 'Ongoing (exploitation attempts detected, mitigation '
                         'released)',
 'lessons_learned': 'Risks of unsafe file handling in WordPress plugins, where '
                    'upload features can be weaponized for RCE. Importance of '
                    'revalidating user-supplied file details and monitoring '
                    'for mixed file extensions.',
 'post_incident_analysis': {'corrective_actions': 'Fixed in Bricksforge '
                                                  'versions 3.1.8.10 and 4.0.1 '
                                                  '(Pro Forms)',
                            'root_causes': 'Insufficient validation in '
                                           'plugin’s form upload process, '
                                           'trust in user-supplied file '
                                           'details without revalidation'},
 'recommendations': ['Update immediately to Bricksforge version 3.1.8.10 or '
                     '4.0.1',
                     'Review logs for suspicious `temporaryFileUploads` '
                     'submissions',
                     'Inspect upload directories for unexpected PHP files',
                     'Monitor for unauthorized script execution or website '
                     'changes',
                     'Use Patchstack’s RapidMitigate rule for temporary '
                     'protection if unable to update'],
 'references': [{'source': 'Patchstack'}],
 'response': {'containment_measures': 'Update to Bricksforge version 3.1.8.10 '
                                      'or 4.0.1, log review, directory '
                                      'inspection',
              'enhanced_monitoring': 'Log monitoring for suspicious '
                                     '`temporaryFileUploads` submissions',
              'recovery_measures': 'Compromise review for exposed '
                                   'installations',
              'remediation_measures': 'Patch release (3.1.8.10), security fix '
                                      'for Pro Forms (4.0.1)',
              'third_party_assistance': 'Patchstack (technical analysis and '
                                        'RapidMitigate rule)'},
 'title': 'Critical Zero-Day Exploit Targets Bricksforge WordPress Plugin '
          '(CVE-2026-85097)',
 'type': 'Zero-Day Exploit',
 'vulnerability_exploited': 'CVE-2026-85097 (CVSS 10.0)'}