Full Report
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The
Analysis Summary
# Vulnerability: Unauthenticated Remote Code Execution in Bricksforge
## CVE Details
- **CVE ID:** CVE-2026-85097
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type) / CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Bricksforge plugin for WordPress (a "Swiss Army knife" extension for the Bricks visual builder).
- **Versions:** Versions up to and including 3.1.8.9.
- **Configurations:** Systems utilizing Bricksforge forms and the REST API or AJAX endpoints.
## Vulnerability Description
The vulnerability exists due to insufficient validation of metadata within the `temporaryFileUploads` parameter during form submissions. While Bricksforge correctly validates a file's MIME type upon initial upload to a temporary directory, it fails to re-validate the `url` field when the form is subsequently submitted.
Attackers can bypass security checks by:
1. Uploading a "polyglot" file (e.g., a GIF containing embedded PHP code) that passes MIME checks.
2. Submitting a request to the `bricksforge_form_submit` action where the `file` path points to the valid image, but the `url` metadata field is modified to have a `.php` extension.
3. The plugin trusts this metadata and places the file contents at the PHP-designated location, enabling code execution.
## Exploitation
- **Status:** Exploited in the wild. Initial automated exploitation efforts were detected starting October 7, 2026.
- **Complexity:** Low (Can be automated; requires no authentication).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Total compromise of sensitive site data and database).
- **Integrity:** High (Ability to modify files, deploy web shells, and alter site content).
- **Availability:** High (Ability to delete files or take the site offline).
## Remediation
### Patches
- **Update to Bricksforge version 3.1.8.10 or later.** This version introduces proper validation for the `url` field and file extensions.
### Workarounds
- No official functional workaround is provided; immediate patching is the primary recommendation.
- Administrators may consider temporarily disabling the Bricksforge REST API endpoints or blocking access to `bricksforge_regenerate_nonce` and `bricksforge_form_submit` via a Web Application Firewall (WAF) if patching is delayed.
## Detection
- **Indicators of Compromise (IoCs):**
- **Observed IPs:** 177.75.57[.]20, 23.97.62[.]1.
- **Endpoints Targeted:** `/wp-json/bricksforge/v1/form_submit` and `/wp-admin/admin-ajax.php` (with action `bricksforge_form_submit`).
- **Files:** Look for GIF, PNG, or PHP files in `wp-content/uploads/bricksforge/tmp/`.
- **Patterns:** Requests containing `temporaryFileUploads` with mismatched extensions or encoded PHP extensions (e.g., `.php5`, `.phtml`, `.%70hp`).
- **Detection Methods:** Review web server access logs for unusual POST requests to the Bricksforge REST API or AJAX endpoints originating from unauthenticated sessions.
## References
- **Vendor Changelog:** hxxps://bricksforge[.]io/version-changelog/
- **Patchstack Advisory:** hxxps://patchstack[.]com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/
- **Wordfence Threat Intel:** hxxps://www.wordfence[.]com/threat-intel/vulnerabilities/wordpress-plugins/bricksforge/bricksforge-3189-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter