WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code
Attackers are exploiting unauthenticated Bricksforge flaw CVE-2026-85097 to upload and run arbitrary PHP.
Attackers are exploiting CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin through version 3.1.8.9, to upload and execute arbitrary PHP without authentication. Patchstack first saw attempts on October 7, 2026, mostly against /wp-json/bricksforge/v1/form_submit, from 63 source IPs, including a burst of 56 identical requests. A GIF or PNG that also contains PHP passes an initial MIME check, then a crafted form submission writes it to a PHP path that the server executes, enabling web shells and data theft. Version 3.1.8.10 is the fix; 4.0.1 also addresses Pro Forms uploads.
76