A severe security vulnerability has been identified in the Bricksforge plugin for WordPress, leading to active exploitation. This flaw, categorized as CVE-2026-85097, has a CVSS score of 10.0, indicating its critical nature. It allows unauthorized individuals to execute arbitrary PHP code on susceptible WordPress sites, facilitating remote code execution (RCE). The issue affects all versions up to and including 3.1.8.9, with a patch available in version 3.1.8.10.
Understanding the Vulnerability
Bricksforge, known as a versatile tool for visual website building on WordPress, is under threat from a critical security loophole. The vulnerability arises from insufficient validation of the URL field in the ‘temporaryFileUploads’ parameter during form submissions. Attackers exploit this by uploading a polyglot file that passes MIME checks but contains executable PHP code, resulting in unauthorized code execution.
Patchstack reported the exploitation efforts on October 7, 2026, identifying a gap in how Bricksforge processes file metadata. By obtaining a valid nonce from the ‘bricksforge_regenerate_nonce’ AJAX endpoint, attackers can manipulate form submissions to execute PHP code via mismatched file URLs.
Exploitation Techniques and Patterns
Exploitation involves an attacker using the polyglot file approach, where a file is both a valid image and contains PHP code. Through strategic form submissions, the server-side path points to this file, while the URL ends with a PHP extension. Observations by Patchstack and Wordfence highlight automated exploitation attempts from multiple IP addresses, indicating the use of rotating proxies or distributed infrastructure.
The attacks involve various PHP extension techniques to bypass filtering, including using alternate extensions and encoded URLs. In one instance, 44 IPs issued 56 similar requests in quick succession, while another cluster tested numerous PHP extension variations.
Mitigation and Precautionary Measures
To counteract this threat, users must update to Bricksforge version 4.0.1 immediately. Site administrators are advised to closely monitor requests to the Bricksforge form submission endpoints, especially those containing the ‘temporaryFileUploads’ parameter. Additionally, auditing for unauthorized PHP files in the ‘/wp-content/uploads/bricksforge/tmp/’ directory is recommended.
In parallel, other WordPress plugins like WPC Product Bundles for WooCommerce and Ninja Forms have also been targeted by threat actors exploiting cross-site scripting vulnerabilities. Site owners should ensure these plugins are updated to prevent further attacks and inspect their sites for any signs of existing exploitation.
Broader Implications and Security Trends
This incident is part of a larger trend of increasing WordPress-related vulnerabilities. In the second quarter of 2026 alone, over 2,000 vulnerabilities were reported, affecting numerous sites globally. The rise in high-threat vulnerabilities underscores the need for robust security measures, such as regular updates and comprehensive scanning for potential threats.
Wordfence emphasizes the importance of a strong firewall, timely patch updates, and vigilant monitoring to safeguard against malicious activities. Real-time alerts and proactive security protocols can help site owners stay ahead in the ever-evolving landscape of cybersecurity threats.
