Bricksforge's unauthenticated upload flaw is being used to run PHP on WordPress sites
Attackers are exploiting CVE-2026-85097, a CVSS 10.0 unauthenticated upload flaw in the Bricksforge WordPress plugin, Patchstack reported. Versions through 3.1.8.9 are affected; 3.1.8.10 is the first fixed build.
The Watch · Security desk
Three figures. The exploitation activity has been recorded from 63 unique source IPs, six of which account for roughly 46% of all requests. In one cluster Patchstack reports, 44 IPs sent 56 requests with identical payloads. The flaw's CVSS 10.0 rating is marked disputed.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Unique source IPs recorded | 63 IPs | six sent roughly 46% of all requests | 14 |
| IPs sending identical payloads | 44 IPs | sent 56 requests within seconds | 7 |
| Severity score | 10 CVSS | disputed | 16 |
What happened
- Patchstack detected the first exploitation attempts on October 7, 2026, at 9:47 p.m. UTC.
- Observed attacks hit the REST endpoint /wp-json/bricksforge/v1/form_submit, or admin-ajax.php with the bricksforge_form_submit action, carrying a crafted temporaryFileUploads parameter.
- Payloads try to get past extension filtering with alternate PHP extensions such as .php5 and .phtml, mixed-case spellings, and URL-encoded variants.
Why it matters
- Who's exposed exposure Any site on 3.1.8.9 or earlier can be reached by anyone who can send HTTP requests, because the nonce the attack needs comes from an unauthenticated endpoint.
- What it limits constraint A server or WAF rule that matches only a literal .php suffix would miss the extension, case and encoding variants attackers are already sending.
- Who has to decide decision Operators pick a target version. The source names 3.1.8.10 as the patched build, then advises the latest, 4.0.1, and does not say whether the jump changes anything for sites built on Bricks.
Next story · Security · Sep 26
One clicked link creates an attacker admin on Elementor 4.3.0 and 4.3.1Confirmed2 publishers
The chain needs no credentials. An attacker first requests a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint, then uploads a GIF/PHP polyglot, a file that is a valid image and also contains PHP, to the temporary upload directory [6]. The MIME check passes it. The attacker then submits a form whose 'file' path points to that validated image while the 'url' ends in a PHP extension, and Bricksforge places the file's contents at the PHP location. The embedded code runs when that file is requested [6]. Wordfence's advisory describes the same sequence [11].
Patchstack put the root cause in terms of what the plugin trusts:
"Bricksforge validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends," Patchstack said. "In particular, it does not validate the 'url' field inside the 'temporaryFileUploads' parameter." [5]
Patchstack's telemetry points to automation. In one cluster, 44 IPs sent 56 requests with identical payloads within seconds of each other. In another, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file [7]. "Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor," Patchstack said [8]. Six of the 63 source IPs sent roughly 46% of requests, so the other 57 addresses account for about 54% [15].
So far the public record shows one bug hit by automated tooling from many addresses.
Updating closes the hole but leaves in place anything already written. The source lists web shells and persistent access among the outcomes of successful exploitation [9]. In the representative request, both the validated GIF and the PHP target sit under wp-content/uploads/bricksforge/tmp [10]. In our view that directory is the first place to look for .php files on any site that ran 3.1.8.9 or earlier after October 7.
The Hacker News report did not disclose whether attacks began before October 7, how many sites are compromised, or when 3.1.8.10 shipped.
What to watch
- Whether Patchstack or Wordfence tie the traffic to a named actor or report the payloads attackers drop after upload, such as web shells.
- Whether the plugin's own release notes clarify if 3.1.8.10 is enough or if sites should move to 4.0.1.
- Whether the count of 63 source IPs grows as the representative request format circulates.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap−5
- Incentives30
- Confidence74
Perspective Coverage
3 publishers- Builder
- Builder 22%
- Operator
- Operator 60%
- Investor
- Investor 18%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A maximum-severity security flaw in the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.
- [2]
The flaw affects Bricksforge versions up to and including 3.1.8.9. Patches have been released in version 3.1.8.10.
- [3]
Patchstack said it detected exploitation efforts targeting the flaw on October 7, 2026, at 9:47 p.m. UTC.
- [4]
The source advises users to update to the latest version of the plugin (4.0.1) to mitigate the threat.
- [5]
"Bricksforge validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends," Patchstack said. "In particular, it does not validate the 'url' field inside the 'temporaryFileUploads' parameter."
- [6]
The exploit chain has four steps: request a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint; upload a GIF/PHP polyglot (a valid image that also contains PHP code) that passes the MIME check and lands in the temporary upload directory; submit a form where the 'file' path points to the validated image but the 'url' ends in a PHP extension; Bricksforge trusts the submitted metadata and places the file's contents at the PHP location, so the embedded code executes when that file is requested.
- [7]
Patchstack said two clusters stand out in its telemetry: in the first, 44 IPs sent 56 requests with identical payloads within seconds of each other; in the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.
- [8]
"Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor," Patchstack said.
- [9]
Successful exploitation could result in arbitrary PHP execution on the server, which an attacker can leverage to seize control of the WordPress site, deploy web shells, read sensitive data, and establish persistent access.
- [10]
In the representative request, the 'file' path is /var/www/example.com/wp-content/uploads/bricksforge/tmp/img_example.gif and the 'url' is https://example.com/wp-content/uploads/bricksforge/tmp/img_example.php, both under the bricksforge/tmp uploads directory.
- [11]
Wordfence said in an advisory that an unauthenticated attacker can obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot to the temporary upload directory, then submit a form with a crafted 'temporaryFileUploads' parameter whose server-side file path points to the validated GIF while the url field ends with a .php extension.
- [12]
In attacks observed by Patchstack, threat actors target the Bricksforge REST API form submission endpoint (/wp-json/bricksforge/v1/form_submit) or /wp-admin/admin-ajax.php with the bricksforge_form_submit action, along with a crafted temporaryFileUploads parameter.
- [13]
To get around extension filtering, the exploitation activity uses alternate PHP extensions (.php5, .php7, .phtml), case manipulation (.PHP, .Php, .pHp), and encoded extensions (.%70hp, %2ephp, .%2570%2568%2570).
- [14]
The activity has been recorded from 63 unique source IPs, with six of them accounting for roughly 46% of all requests.
- [15]
The 57 source IPs outside the top six (63 minus 6) account for about 54% of requests (100% minus roughly 46%).
- [16]
CVE-2026-85097 (CVSS 10.0) allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution.
Sources
3 independent publishers whose own reporting we read for this story.
- scworld.comCritical Bricksforge WordPress flaw exploited in attacks
1 article · October 12, 2026
- securityweek.comBricksforge WordPress Plugin Vulnerability Exploited in the Wild
1 article · October 12, 2026
- thehackernews.comAttackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
1 article · October 12, 2026
Topics and entities
Topics
- Remote Code Execution Surfaces
- Exploitation In The Wild
- WordPress Plugin Security