Story · 6 sources · 6 articlesfirst Oct 12, 09:02 UTCupdated Oct 15, 15:16 UTC (1d ago)

Bricksforge RCE Exploited; Separate Backuply SQL Flaw Patched

criticalExploit / PoCexploited in the wildimportance 82CVE-2026-85097 CVE-2026-93836 CVE-2026-94504 CVE-2026-93953

What's new: Wordfence’s October 15 report adds a separate Backuply flaw, CVE-2026-93953 (CVSS 8.0), fixed in 1.5.9; it does not change the earlier Bricksforge exploitation account.

Merged summary · grok-4.7-build · rewritten as coverage arrives

Attackers are exploiting Bricksforge CVE-2026-85097 for unauthenticated RCE, while a separate Backuply SQL injection on over 600,000 sites was patched.

Patchstack and several outlets report active exploitation of CVE-2026-85097 in the Bricksforge WordPress plugin through version 3.1.8.9, which lets unauthenticated attackers upload files and execute PHP. Attempts began on October 7, 2026, before Patchstack’s October 8 disclosure, from 63 source IPs in automated clusters aimed mainly at form submission; Cyber Security News specifies /wp-json/bricksforge/v1/form_submit and a burst of 56 identical requests. Sources disagree on severity: The Hacker News, GBHackers, and Cyber Security News give CVSS 10.0, while SecurityWeek reports 9.8, says roughly 6,000 sites use the plugin, and says the activity was not attributed to one actor. The commonly cited fix is 3.1.8.10; The Hacker News also cites 4.0.1, which Cyber Security News limits to Pro Forms uploads, and only The Hacker News connects XSS flaws CVE-2026-93836 and CVE-2026-94504 to a backdoor plugin and hidden admin accounts. Separately, Wordfence disclosed CVE-2026-93953, a CVSS 8.0 second-order SQL injection in Backuply through 1.5.8 affecting more than 600,000 sites, patched in 1.5.9 on October 1 after a September 17 report.

CVE-2026-85097 in Bricksforge through 3.1.8.9 allows unauthenticated file upload and PHP execution; The Hacker News, GBHackers, and Cyber Security News rate it CVSS 10.0, while SecurityWeek reports 9.8.
Patchstack observed exploitation from October 7, 2026, before an October 8 disclosure, from 63 source IPs in automated clusters; Cyber Security News cites /wp-json/bricksforge/v1/form_submit and a burst of 56 identical requests.
The commonly cited fix is Bricksforge 3.1.8.10; The Hacker News also lists 4.0.1, which Cyber Security News limits to Pro Forms uploads. SecurityWeek says roughly 6,000 sites use the plugin and activity was unattributed.
Only The Hacker News links XSS flaws CVE-2026-93836 (WPC Product Bundles) and CVE-2026-94504 (Ninja Forms) to a JavaScript implant that installs a backdoor plugin and hidden admin accounts.
Separately, Wordfence disclosed CVE-2026-93953, a CVSS 8.0 authenticated second-order SQL injection in Backuply through 1.5.8 on more than 600,000 sites, fixed in 1.5.9 on October 1, 2026.

VendorsBackuply

ProductsBricksforge WordPress Bricks Builder Bricks Backuply

OrganizationsPatchstack Wordfence Bricksforge Ninja Forms WPC Product Bundles SOCRadar

Coverage timelineoldest first · each row is one article

Oct 12, 09:02 UTC · 4d ago
The Hacker News· 82
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Attackers actively exploit CVSS 10.0 flaw CVE-2026-85097 in Bricksforge WordPress plugin for unauthenticated RCE.
Oct 12, 12:45 UTC · 4d ago
GBHackers· 82
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are exploiting unauthenticated RCE CVE-2026-85097 in the WordPress Bricksforge plugin.
Oct 12, 13:14 UTC · 4d ago
SecurityWeek· 74
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Vulnerabilities in this storyAll →

CVE-2026-850979.8<1%
Unauthenticated file upload to RCE in WordPress Bricksforge
published 8d ago· Bricksforge PoC ×5
CVE-2026-938367.2—
Unauthenticated Stored XSS in WPC Product Bundles for WooCommerce

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-85097	Unauthenticated file upload to RCE in WordPress Bricksforge The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload (CWE-434) in versions up to and including 3.1.8.9 because an attacker-controlled URL in the temporaryFileUploads parameter is not sufficiently validated during form submission. An unauthenticated attacker can cause a file that passed temporary upload checks to be referenced with a PHP extension and executed by the server. Successful exploitation allows arbitrary PHP code execution and can fully compromise the site (confidentiality, integrity, and availability), with a CVSS 3.1 score of 9.8. WordPress sites running Bricksforge 3.1.8.9 or earlier are affected. No public proof of concept is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog. Do: Update Bricksforge to a release newer than 3.1.8.9 as soon as the vendor publishes a fix; the advisory data does not name a patched version. Until then, deactivate the plugin or otherwise block unauthenticated access to its form handling, and review the temporary and public upload directories for unexpected PHP files.	9.8	<1%	PoC ×5	Bricksforge up to and including 3.1.8.9	—	8d ago
CVE-2026-93836	Unauthenticated Stored XSS in WPC Product Bundles for WooCommerce The WPC Product Bundles for WooCommerce plugin for WordPress contains a stored cross-site scripting vulnerability in all versions up to and including 8.6.6, caused by insufficient sanitization of the 'qty' parameter. Because quantity validation uses a float cast, a numeric-prefixed script payload can pass the check while its malicious HTML survives intact and is stored verbatim in order item metadata under the '_woosb_ids' key. An unauthenticated attacker can exploit this by submitting a crafted bundle quantity, and the injected script executes in the browser of any user — including store staff or administrators — who views the affected page or order. Any site running the plugin at or below version 8.6.6 with WooCommerce is affected. No public proof of concept is known and the flaw is not on the CISA KEV catalog, so exploitation is not currently observed. Do: Update to the latest version of WPC Product Bundles for WooCommerce (anything newer than 8.6.6) as soon as a patched release is available. Audit order item metadata for the '_woosb_ids' key and look for numeric-prefixed values containing unexpected HTML or script tags, and remove any found entries. Until patched, apply a WAF rule blocking HTML/script characters in 'qty' parameters on bundle add-to-cart requests, and remind admins to view orders only in sanitized contexts.	7.2	—		WPClever WPC Product Bundles for WooCommerce (WordPress plugin) All versions up to and including 8.6.6	large≈30,000–40,000 WooCommerce sites (tens of thousands of active installs)
CVE-2026-93953	Second-order SQL injection in Backuply WordPress plugin The Backuply WordPress plugin (versions through 1.5.8) has a second-order SQL injection in how it handles the user Biographical Info field. The plugin writes that value verbatim into an INSERT statement in the backup SQL dump (wp_usermeta); when an administrator later restores the backup, a crafted value can break out of the INSERT and run additional SQL with full database privileges. An authenticated attacker with subscriber-level access or higher can use this to change stored options—notably setting default_role to administrator and enabling open registration—so a later registration becomes an administrator, leading to privilege escalation and full site takeover. The injection runs during restore and is suited to modifying records rather than reading data back to the attacker. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Update the Backuply plugin to a release newer than 1.5.8 as soon as one is available from the vendor or WordPress.org. Until then, limit who can edit user profiles (including Biographical Info), restore only backups you trust, and after any restore check wp_options (especially default_role and user-registration settings) and recently created administrator accounts for unexpected changes.	8.0	—		Softaculous Backuply – Backup, Restore, Migrate and Clone all versions up to and including 1.5.8	large≈600,000 WordPress sites	23h ago
CVE-2026-94504	Stored XSS in Ninja Forms 3.15.3 Legacy Submission Editor Ninja Forms 3.15.3 stores values submitted through anonymous (no login required) non-rich-text textarea fields and renders them in the legacy submission editor without safe HTML encoding, allowing an attacker to break out of the textarea with injected script. When an administrator opens the direct submission URL for that entry in wp-admin, the script executes in the WordPress admin origin, enabling session hijacking, unauthorized administrative actions, or creation of a backdoor admin account. Any WordPress site running this version with public forms whose submissions are viewed in the legacy editor is affected. There is no known public proof-of-concept, no CISA KEV entry, and no observed in-the-wild exploitation, but the attack only requires submitting a crafted form entry and getting an admin to view it (CVSS 3.1: 7.2, AV:N/AC:L/PR:N). Do: Upgrade Ninja Forms from 3.15.3 to the latest patched release from WordPress.org as soon as possible. Review stored submissions for HTML/script breakout in textarea fields, and audit for unexpected administrator accounts, changed settings, or newly installed plugins/themes that could indicate a hijacked admin session. As defense in depth, restrict submission viewing to trusted roles and treat links to specific submission URLs from untrusted sources with caution.	7.2	<1%	PoC	Saturday Drive Ninja Forms (WordPress plugin) 3.15.3