Skip to content
Hacker Posts

Bricksforge WordPress plugin RCE exploited within days (CVE-2026-85097)

CVE-2026-85097, an unauthenticated arbitrary file upload in the Bricksforge plugin, is under active exploitation. Patch to 3.1.8.10. Patchstack saw attacks from October 7.

Published 2 min read
cvewordpressbricksforgerce

An unauthenticated arbitrary file upload in the Bricksforge WordPress plugin, tracked as CVE-2026-85097, is being exploited in the wild. The flaw lets an attacker upload and run PHP on a vulnerable site — full remote code execution with no login. The fix is in 3.1.8.10.

Primary source is the Patchstack advisory, whose telemetry first caught exploitation attempts on October 7, 2026 at 21:47 UTC.

What's affected

  • Plugin: Bricksforge (an add-on for the Bricks site builder), used on roughly 6,000 sites.
  • Vulnerable: versions 3.1.8.9 and earlier.
  • Fixed: 3.1.8.10.

The root cause (CWE-434) is in form handling: the plugin checks MIME type at upload but then trusts the client-supplied url field inside the temporaryFileUploads parameter at form submission. An attacker grabs a nonce, uploads a GIF/PHP polyglot that passes the MIME check, then submits a form pointing the url field at a .php path.

A note on severity: Patchstack scores it 10.0, while the CVE record and Wordfence list it 9.8. Either way it is an unauthenticated-RCE-class bug — patch it.

Exploitation status

Patchstack reports active exploitation beginning October 7. Its writeup attributes the following indicators to its own detection data — reproduced here verbatim.

Targeted endpoints:

/wp-json/bricksforge/v1/form_submit
/wp-admin/admin-ajax.php   (action=bricksforge_form_submit)
bricksforge_regenerate_nonce

Top source IPs (6 of 63 observed, ~46% of requests):

177.75.57[.]20
23.97.62[.]146
84.247.60[.]125
38.154.185[.]97
150.109.16[.]166
153.75.90[.]146

Attackers rotated extensions and encodings to dodge filters: .php5, .php7, .phtml, case variants (.PHP, .pHp), and URL-encoded forms (.%70hp, %2ephp).

Action checklist

  1. Update Bricksforge to 3.1.8.10 now. If you cannot, deactivate the plugin until you can.
  2. Apply Patchstack's virtual patch / WAF rule if you run its protection, to block attempts until the update lands.
  3. Hunt for dropped payloads in /wp-content/uploads/bricksforge/tmp/ and anywhere else uploads land — look for unexpected .php and polyglot files.
  4. Check access logs for repeated temporaryFileUploads submissions and hits on the endpoints above from the listed IPs.
  5. Assume compromise if you find a web shell: rotate WordPress salts, admin and database credentials, and review for added admin users.

Context

This is the latest in a steady run of WordPress plugin RCEs reaching mass-exploitation within days of disclosure — the same shape as the Everest Forms Pro unauthenticated RCE and the wp2shell pre-auth chain (CVE-2026-63030). Opportunistic scanners now weaponize an unauthenticated file-upload flaw in hours, not weeks. If your plugin inventory includes anything that accepts file uploads, the window between disclosure and exploitation is the only margin you get.

Related stories