Bricksforge (Bricks Builder add-on for WordPress) CVE-2026-85097: unauthenticated PHP upload to remote code execution exploited in the wild since 7 October; update to the latest release (4.0.1, or 3.1.8.10 on the 3.x line)

Patchstack said on 8 October 2026 that attackers are exploiting CVE-2026-85097, a critical flaw in Bricksforge, a commercial add-on for the Bricks visual site builder on WordPress that adds Pro Forms, animations and dynamic data features. Bricksforge is sold outside WordPress.org, so sites will not see it in the usual plugin directory alerts. The plugin checks a file's MIME type when it is first uploaded, but on form submission it trusts the file metadata the browser sends and does not validate the 'url' field in the temporaryFileUploads parameter. Wordfence, which assigned the CVE, describes the chain: an attacker with no account gets a valid nonce from the bricksforge_regenerate_nonce AJAX action, uploads a GIF/PHP polyglot that passes the image check, then submits a form whose server-side path points at the validated GIF while the url ends in .php, so the file is written as PHP and can be run. That gives full control of the site: web shells, content changes, data theft and persistence. Patchstack first saw attacks at 21:47 UTC on 7 October (8 October, 5:47am Perth). All but one request went to POST /wp-json/bricksforge/v1/form_submit; the other used /wp-admin/admin-ajax.php with the bricksforge_form_submit action. Most payloads targeted /wp-content/uploads/bricksforge/tmp/, some dropped login_admin_*.php files into normal uploads folders such as /wp-content/uploads/2026/10/, and attackers tried alternate extensions (.php5, .php7, .phtml), mixed case and URL-encoded extensions to get past filters. Patchstack logged 63 source IPs across datacentre, cloud, VPN and residential ranges, including one cluster of 44 IPs sending identical payloads within seconds, which points to automated mass exploitation; no actor has been named and no count of compromised sites published. Version note: Patchstack and Wordfence list versions up to and including 3.1.8.9 as affected and 3.1.8.10 as fixed. The vendor's public changelog has no 3.1.8.10 entry; it lists 4.0.0 (17 September) and then 4.0.1 (8 October), 'Security fix for the Pro Forms file upload', which it says affects every site with Pro Forms active, even forms with no upload field. Whether 4.0.0 is affected is not stated, so move to 4.0.1 or later. Scores differ: Patchstack rates it CVSS 10.0; the CVE record and Wordfence give 9.8. Primary: Patchstack (8 Oct); wire: The Hacker News (12 Oct).

Product

Bricksforge (commercial add-on for Bricks Builder, WordPress) — Pro Forms file upload

Versions

Up to and including 3.1.8.9 (CVE record). Fixed per Patchstack/Wordfence: 3.1.8.10; vendor changelog lists the fix in 4.0.1 (8 Oct 2026). 4.0.0 status not stated.

CVSS

10.0 (Patchstack); 9.8 (CVE record, Wordfence CNA, CVSS 3.1)

Exploited in Australia?

unknown

Patch to

Update Bricksforge to 4.0.1 or later (3.1.8.10 on the 3.x line per Patchstack and Wordfence). Agencies and AU web hosts running Bricks sites: inventory client sites for Bricksforge, since it is not on WordPress.org. Then hunt: look for any PHP file under wp-content/uploads (especially bricksforge/tmp/ and login_admin_*.php), and search logs since 7 Oct for bricksforge_regenerate_nonce, form_submit and temporaryFileUploads. If you find a PHP file, treat the site as compromised: rebuild or clean it, and rotate WordPress admin passwords, database credentials and salts.

Primary: Patchstack — Critical unauthenticated arbitrary file upload vulnerability exploited in Bricksforge plugin (8 Oct 2026) · Vendor: Bricksforge version changelog — 4.0.1, Security fix for the Pro Forms file upload (8 Oct 2026) · CVE: CVE-2026-85097 · Wordfence Intelligence — Bricksforge <= 3.1.8.9 unauthenticated arbitrary file upload via 'temporaryFileUploads' (CVE-2026-85097)

vulnerabilities