Critical Vulnerability in Bricksforge WordPress Plugin Exposes Users to Attacks
A severe safety threat has emerged concerning the Bricksforge WordPress plugin, which is currently being exploited by malicious actors. This vulnerability, identified as CVE-2026-85097, allows unauthorized users to upload harmful files and execute arbitrary PHP code, thus posing a significant risk to website administrators. With a CVSS score of 10.0—the highest possible rating for security vulnerabilities—this flaw impacts all versions of Bricksforge up to 3.1.8.9. Website administrators are strongly urged to upgrade to version 3.1.8.10 or later to mitigate the threat.
The alarming details of this vulnerability were unveiled by Patchstack, which disclosed the issue on October 8, 2026. Just a day earlier, on October 7 at 21:47:17 UTC, exploitation attempts had already commenced. This rapid escalation serves as a stark reminder of the vulnerabilities that orbits popular plugins like Bricksforge, which is designed to enhance the Bricks Builder by offering advanced forms, dynamic data management, animations, and customization options.
The root cause of this security breach lies in the inadequate validation between file uploads and the subsequent processing of form submissions. Initially, Bricksforge performs a MIME type check on uploaded files; however, it later relies on trusting client-provided metadata. This includes the URL field present in the temporaryFileUploads parameter, which can be manipulated by attackers.
Through the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, attackers can acquire a valid nonce. Subsequently, they upload a GIF/PHP polyglot—a unique file format that combines valid image data with embedded PHP code. This dual functionality allows the malicious file to bypass initial MIME type validation and become stored in the temporary uploads directory.
When the attack progresses to form submission, the malicious individual can supply metadata linking to the previously validated image, specifying a destination URL that ends in a PHP extension. The Bricksforge system then unknowingly places the file in the specified location. Consequently, when the attacker requests this resultant PHP file, it executes the harmful code contained within, potentially leading to dire consequences such as unauthorized web shell access, data theft, content manipulation, and lasting access to the compromised system.
Most attacks have targeted the POST /wp-json/bricksforge/v1/form_submit endpoint. In one notable instance, a request utilized /wp-admin/admin-ajax.php with the bricksforge_form_submit action. Each of the captured requests was found to include meticulously crafted temporaryFileUploads metadata, indicating a calculated effort on the part of the attackers.
Among the requests captured, roughly 95% showed that the server-side file path ended with file extensions such as .gif or .png. Furthermore, many of these paths were paired with PHP-related destination URLs. Attackers have aggressively probed the validation process by experimenting with alternative extensions, mixed capitalization, URL encoding techniques, and modified metadata fields. Some of the more discerning payloads utilized filenames in standard WordPress upload directories, such as login_admin_*.php.
Patchstack has identified a total of 63 unique source IP addresses involved in these attacks, where six IPs accounted for approximately 46% of the requests. Intriguingly, one cluster included 44 IPs that sent 56 identical requests in rapid succession. Another cluster saw just three IPs trying out 25 variations of extensions and encoding, hinting at an organized, automated exploitation effort. However, these patterns do not definitively point to a specific threat actor.
To combat this vulnerability, it is critical that administrators promptly update their Bricksforge plugin to version 3.1.8.10 or newer. For those who may not be able to implement an immediate upgrade, Patchstack has proposed a RapidMitigate traffic-layer rule as a temporary solution.
Additionally, administrators are advised to diligently review logged activities for suspicious entries involving form submissions, discrepancies between image and PHP metadata, nonce requests followed by file uploads, and any queries directed at newly generated PHP files. They should also perform thorough inspections of the /wp-content/uploads/bricksforge/tmp/ directory alongside other upload locations for suspect scripts, particularly those titled login_admin_*.php.
As the landscape of cyber threats evolves, maintaining updated defenses against emerging malware is of paramount importance. Continuous risk assessments and the integration of threat intelligence feeds from reliable sources can provide a much-needed buffer against such vulnerabilities.