WordPress Security Alert: Critical Bricksforge Vulnerability Exposes Sites to Remote Code Execution

Summary

Vulnerability Details

Affected Versions

Bricksforge versions up to and including 3.1.8.9 are affected by CVE-2026-85097.

Fixed Version

Upgrade Bricksforge to version 3.1.8.10 or later to address the vulnerability.

Technical Information

CVE-2026-85097: Unauthenticated Arbitrary File Upload Leading to RCE

The vulnerability originates from insufficient validation of uploaded file metadata during form submission. Although the plugin validates a file's MIME type during the initial upload, it does not adequately validate the client-supplied url field within the temporaryFileUploads parameter when processing a subsequent form submission.

An unauthenticated attacker can obtain a valid nonce through the bricksforge_regenerate_nonce AJAX endpoint and upload a GIF/PHP polyglot file to the temporary upload directory. This file appears to be a valid image while also containing PHP code, allowing it to pass the initial MIME type validation.

The attacker can then submit a crafted form request that references the uploaded image through the server-side file path while specifying a PHP-based destination in the url field. Because the submitted metadata is insufficiently validated, the file contents can be placed at a PHP execution path, allowing the embedded code to execute when the resulting file is requested.

Observed exploitation attempts targeted the following endpoints:

• /wp-json/bricksforge/v1/form_submit
• /wp-admin/admin-ajax.php using the bricksforge_form_submit action

Attackers have attempted to evade extension filtering using alternate PHP extensions such as .php5, .php7, and .phtml, mixed-case extensions such as .PHP and .pHp, and encoded extensions such as .%70hp, %2ephp, and .%2570%2568%2570.

Impact

Successful exploitation can result in the following security impacts:

• Remote Code Execution: Attackers can execute arbitrary PHP code on the affected server, potentially gaining control over the application environment.
• Website Compromise: Attackers can gain unauthorized control over the WordPress website and modify its content, functionality, or configuration.
• Sensitive Data Exposure: Attackers may access sensitive files, application data, configuration details, or credentials available to the compromised server process.
• Web Shell Deployment: Attackers can upload malicious PHP files or web shells to execute commands remotely and maintain control of the compromised website.
• Persistent Unauthorized Access: Attackers may maintain access through malicious files, unauthorized account changes, or other modifications made after successful exploitation.

MITRE ATT&CK Mapping

Indicators of Compromise (IoCs)

The observed exploitation activity originated from 63 unique source IP addresses. Six IP addresses accounted for approximately 46% of the recorded requests.

Observed Source IP Addresses

Additional Attack Indicators

These indicators should be correlated with web server logs and file-system activity. Their presence can support an investigation but does not independently confirm successful compromise.

Mitigation and Recommendations

• Update Bricksforge: Upgrade to version 3.1.8.10 or later to address the vulnerability.
• Review Web Server Logs: Investigate suspicious requests to the form submission endpoints, particularly those containing crafted temporaryFileUploads parameters or mismatched file paths and URLs.
• Inspect Temporary Uploads: Examine /wp-content/uploads/bricksforge/tmp/ for unexpected PHP files, image/PHP polyglots, and unauthorized file modifications.
• Investigate Potential Compromise: Check for web shells, suspicious PHP execution, unauthorized changes, and signs of persistence. Remove malicious artifacts and restore affected systems from trusted sources as necessary.
• Strengthen File Upload Validation: Validate file contents, extensions, destination paths, and metadata on the server. Do not trust client-supplied URLs to determine file placement or executable paths.

Instantly Fix Risks with Saner Patch Management