WordPress Security Alert: Critical Bricksforge Vulnerability Exposes Sites to Remote Code Execution
A critical vulnerability in the Bricksforge plugin for WordPress is being actively exploited, allowing unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable websites. Tracked as CVE-2026-85097, the flaw stems from insufficient validation of file metadata during form submissions. Successful exploitation can enable attackers to compromise websites, access sensitive information, deploy web shells, and establish persistent access.
Summary
CVE-2026-85097 is a critical arbitrary file upload vulnerability
in the Bricksforge WordPress plugin. Unauthenticated attackers
can exploit insufficient validation of the url
field in the temporaryFileUploads parameter to
upload files containing PHP code and execute that code on the
affected server.
Exploitation attempts were first observed on October 7, 2026. Reported attack attempts include alternate PHP extensions, mixed-case extensions, and encoded extensions intended to bypass file-extension filtering.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Vulnerability Type | Affected Versions |
|---|---|---|---|---|
| CVE-2026-85097 | 9.8 (Critical) | 0.31% | Arbitrary File Upload / Remote Code Execution | 3.1.8.9 and earlier |
Technical Information
CVE-2026-85097: Unauthenticated Arbitrary File Upload Leading to RCE
The vulnerability occurs because the plugin does not adequately
validate uploaded file metadata during form submission. Although
MIME type validation is performed during the initial upload, the
subsequent form submission does not sufficiently validate the
client-controlled url field within the
temporaryFileUploads parameter.
An unauthenticated attacker can obtain a nonce through the
bricksforge_regenerate_nonce AJAX endpoint and upload
a GIF/PHP polyglot file to the temporary upload directory. Such a
file can contain valid image data alongside PHP code, potentially
allowing it to pass the initial MIME type validation.
The attacker can then submit a crafted form request in which the
server-side file path references the uploaded image
while the client-controlled url specifies a PHP-based
destination. Insufficient validation can allow the content to be
written to a PHP execution path, resulting in remote code execution
when the resulting file is processed by the server.
Reported exploitation attempts target the following endpoints:
-
/wp-json/bricksforge/v1/form_submit -
/wp-admin/admin-ajax.phpusing thebricksforge_form_submitaction
Reported extension-filtering bypass attempts include alternate PHP
extensions such as .php5, .php7, and
.phtml; mixed-case extensions such as
.PHP and .pHp; and encoded patterns such
as .%70hp, %2ephp, and
.%2570%2568%2570.
Impact
Successful exploitation can result in the following security impacts:
- Remote Code Execution: Attackers can execute arbitrary PHP code on the affected server, potentially gaining control over the application environment.
- Website Compromise: Attackers can modify website content, functionality, and configuration, potentially disrupting normal operations.
- Sensitive Data Exposure: Attackers may access application data, configuration files, and credentials available to the compromised server process.
- Malicious File Deployment: Attackers can place malicious PHP files on the server and potentially use them to execute further commands.
- Persistent Unauthorized Access: Attackers who gain code execution may establish continued access through malicious files or unauthorized changes.
MITRE ATT&CK Mapping
The following techniques describe the documented exploitation path and potential follow-on behavior. Techniques beyond the initial access mapping are conditional on the attacker's subsequent actions.
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1505.003 | Web Shell | Persistence |
| T1036.008 | Masquerade File Type | Defense Evasion |
Indicators of Compromise (IoCs)
Reported exploitation telemetry identified 63 unique source IP addresses. The following six addresses reportedly accounted for approximately 46% of recorded requests. Treat these indicators as investigation leads rather than definitive proof of compromise.
Observed Source IP Addresses
177.75.57[.]2023.97.62[.]14684.247.60[.]12538.154.185[.]97150.109.16[.]166153.75.90[.]146
Additional Attack Indicators
-
Request parameter:
temporaryFileUploads -
Temporary upload directory:
/wp-content/uploads/bricksforge/tmp/ -
REST API endpoint:
/wp-json/bricksforge/v1/form_submit -
AJAX endpoint:
/wp-admin/admin-ajax.php -
AJAX action:
bricksforge_form_submit -
Nonce endpoint:
bricksforge_regenerate_nonce -
Alternate PHP extensions:
.php5,.php7,.phtml -
Mixed-case extensions:
.PHP,.pHp -
Encoded extension patterns:
.%70hp,%2ephp,.%2570%2568%2570
Correlate these indicators with web server access logs, application logs, and file-system activity. Investigate unexpected PHP files, suspicious form submissions, and unauthorized changes. The presence of an indicator alone does not confirm successful exploitation.
Mitigation and Recommendations
- Upgrade to a Fixed Version: Update Bricksforge to version 3.1.8.10 or later.
-
Review Web Server Logs:
Investigate suspicious requests to the form submission
endpoints, especially requests containing crafted
temporaryFileUploadsparameters or mismatched file paths and URLs. -
Inspect Temporary Uploads:
Examine
/wp-content/uploads/bricksforge/tmp/for unexpected PHP files, image/PHP polyglots, and unauthorized file modifications. - Investigate Potential Compromise: Check for web shells, suspicious PHP execution, unauthorized account changes, and signs of persistence. Remove malicious artifacts and restore affected systems from trusted sources when necessary.
- Strengthen File Upload Validation: Validate file contents, extensions, destination paths, and metadata on the server. Do not rely on client-supplied URLs to determine file placement or executable paths.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
