WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code

Attackers are targeting a critical security flaw in the Bricksforge WordPress plugin that lets them upload and run arbitrary PHP code without logging in.

Tracked as CVE-2026-85097, the vulnerability carries a maximum CVSS score of 10.0 and can lead to remote code execution on affected websites. Patchstack first observed exploitation attempts on October 7, 2026, at 21:47:17 UTC.

The flaw affects Bricksforge versions up to and including 3.1.8.9. Patchstack identifies version 3.1.8.10 as the fixed release. Bricksforge extends Bricks Builder with advanced forms, animations, dynamic data tools, and site controls. Its form upload process is at the center of this attack.

According to Patchstack’s technical report, Bricksforge checks a file’s MIME type during the initial upload. This check helps identify whether the submitted file is an allowed image. However, when a form is submitted later, the plugin trusts the visitor-supplied file details without properly checking the URL field inside temporaryFileUploads.

Attackers exploit this gap by uploading a file that looks like a GIF but also contains PHP code. The image passes the first check and enters the temporary upload directory. A crafted form submission then pairs the image’s server path with a destination URL ending in a PHP extension.

Bricksforge accepts those details and places the file contents at the PHP destination. Requesting that file causes the server to execute the hidden code.

Attackers can then install web shells, change website content, read sensitive data, or maintain access. The attack also uses the publicly accessible bricksforge_regenerate_nonce AJAX action to obtain a valid request token.

WordPress Plugin Vulnerability Exploited

This is separate from the earlier Bricks Builder remote code execution vulnerability. It also highlights risks seen in other WordPress plugin file upload flaws, where unsafe file handling can turn an upload feature into a code execution path.

Almost every captured attempt targeted /wp-json/bricksforge/v1/form_submit. One used /wp-admin/admin-ajax.php with the bricksforge_form_submit action. In 95% of requests, the server path ended in .gif or .png, often paired with a PHP destination URL.

Attackers tested extensions including .php5, .php8, and .phtml, alongside mixed capitalization and encoded filenames. Some attempted to place login_admin_*.php files outside the temporary directory, in regular WordPress upload folders.

Patchstack recorded 63 source IP addresses. One cluster involved 44 IPs sending 56 identical requests within seconds. Another involved three IPs testing 25 extension and encoding variations. These patterns suggest automated activity using distributed infrastructure, but they do not establish a single attacker’s identity.

Administrators should update affected installations to version 3.1.8.10 or later. The vendor changelog also lists a Pro Forms upload security fix in version 4.0.1, released October 8, and urges updates even when active forms have no upload fields.

Review logs for crafted temporaryFileUploads submissions and inspect /wp-content/uploads/bricksforge/tmp/ and other upload directories for unexpected PHP files. Check for requests to newly created scripts and unauthorized changes.

Patchstack says its RapidMitigate rule blocks exploitation attempts, offering temporary protection when immediate updates are not possible. Sites previously exposed should still undergo a compromise review.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC