Bricksforge · Exploitation reported

Unauthenticated RCE in Bricksforge WordPress Plugin Actively Exploited

Oct 06, 2026 · 1 min read

The Bricksforge WordPress plugin has an unauthenticated remote code execution flaw (CVE-2026-85097, CVSS 10.0 per SOCRadar). Patchstack has recorded exploitation attempts since October 7, 2026, from 63 unique source IPs, and versions up to 3.1.8.9 are affected. Update to 3.1.8.10 or the current 4.0.1 release.

By HIFY Radar newsroom Updated 10/26/2026 01:34 PM Get this every day →← Back to the feed 4 sources

HighVulnerabilityExploitation reportedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The Bricksforge WordPress plugin, used by roughly 6,000 websites according to Patchstack, has a flaw that lets attackers take full control of a site without credentials. The flaw (CVE-2026-85097) has been exploited in real attacks since October 7, 2026. The vendor has released a fix.

Why it matters

An attacker can execute arbitrary code, deploy web shells, modify site content and read sensitive data. The vendor states that every site with Pro Forms active is affected, including forms without upload fields. The attacks are automated and distributed, with 63 unique source IPs recorded.

What to do

Update Bricksforge immediately to 3.1.8.10 or, preferably, the current 4.0.1 release. Review upload directories for unexpected PHP files (such as login_admin_*.php) and access logs, because updating does not remove already planted files. If updating is not possible now, apply a WAF rule that blocks form submissions pairing an image path with a PHP destination URL.

For the technical team

CVE: CVE-2026-85097
Affected: Bricksforge (plugin WordPress) · Bricksforge <= 3.1.8.9 (WordPress plugin); the vendor states every site with Pro Forms active is affected, even forms without upload fields.
Exploitation: Active exploitation reported by Patchstack, first attempts observed October 7, 2026 at 21:47 UTC; covered by SOCRadar and SecurityWeek. Wordfence describes the same chain in its advisory.
Fix: Update to 3.1.8.10 or later; current release 4.0.1 (October 8, 2026), whose changelog lists the Pro Forms file upload security fix. Mitigation: WAF or virtual patching rule blocking form submissions pairing image paths with PHP destination URLs.
Vector: Bricksforge (WordPress plugin), Pro Forms file upload handling. Unauthenticated arbitrary file upload leading to remote code execution: the url field inside the temporaryFileUploads parameter is not validated at form submission. Exploitable on an internet-exposed site with Pro Forms active; no login required.
More details: Chain (SOCRadar, based on Patchstack and Wordfence): nonce obtained without authentication from the bricksforge_regenerate_nonce AJAX endpoint; upload of a GIF/PHP polyglot that passes the MIME check and lands in the temporary directory; form submission with the file path pointing to the validated image while the url ends in .php; Bricksforge places the contents at the PHP location and the server executes the code. All but one attempt targeted POST /wp-json/bricksforge/v1/form_submit; one hit /wp-admin/admin-ajax.php with the bricksforge_form_submit action. In 95% of requests the server-side path ended in .gif or .png; some payloads used destination filenames matching login_admin_*.php in /wp-content/uploads/2026/10/. Payload variations: extensions .php5.php7.php8.phtml.pht.phtm.phps; case manipulation (.PHP.Php.pHp.PHTML); single and double URL encoding (%2ephp.%70hp.%2570%2568%2570); altered or missing path, name, originalFilename and url fields. Two clusters: 44 IPs sent 56 requests with identical payloads within seconds; 3 IPs tested 25 variations against the same temporary file. Patchstack assesses automated exploitation over rotating proxies or distributed infrastructure, with no attribution to a single threat actor. CVSS: 10.0 per SOCRadar and The Hacker News; 9.8 per SecurityWeek. MITRE ATT&CK T1190.