Bricksforge WordPress plugin vulnerability reportedly exploited in the wild

A maximum-severity security flaw in the Bricksforge plugin for WordPress is reportedly being exploited in the wild, according to the WordPress security firm Patchstack. The vulnerability is tracked as CVE-2026-85097 and can let unauthenticated attackers run their own code on vulnerable sites. Patchstack says it first observed exploitation attempts on 7 October 2026 at 21:47 UTC.

What's happening

According to Patchstack, the flaw allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). Patchstack rates the bug CVSS 10.0; some coverage cites a score of 9.8. Either way it is classified as critical.

The problem is in how Bricksforge handles file uploads in its forms. Patchstack explains that the plugin validates a file's MIME type when the file is first uploaded, but when a form is later submitted it trusts the file metadata the client sends — and specifically does not validate the url field inside the temporaryFileUploads parameter. That gap is reported to give attackers a four-step path to code execution:

Request a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint.
Upload a GIF/PHP "polyglot" — a file that is a valid image but also contains PHP code — which passes the MIME check and lands in the temporary upload directory.
Submit a form where the file path points to that validated image, but the url ends in a PHP extension.
Bricksforge reportedly trusts the submitted metadata and places the file's contents at the PHP location, so the embedded code runs when the file is requested.

In the activity Patchstack observed, the requests targeted the Bricksforge REST API form-submission endpoint /wp-json/bricksforge/v1/form_submit, or /wp-admin/admin-ajax.php with the bricksforge_form_submit action, each carrying a crafted temporaryFileUploads parameter.

Patchstack described two clusters in its telemetry: in one, 44 IP addresses sent 56 requests with identical payloads within seconds of each other; in the other, three IP addresses tested 25 variations of PHP extensions and encodings against the same temporary file. Patchstack said both patterns point to automated exploitation over rotating proxies or distributed infrastructure, but that they do not on their own attribute the activity to a single threat actor.

This is an evolving situation, and the picture can change as more telemetry is published.

Who's affected

WordPress sites running Bricksforge versions up to and including 3.1.8.9. According to Patchstack and The Hacker News, the issue is fixed in version 3.1.8.10. Sites on 3.1.8.10 or later are not affected by this flaw.
No login is required to exploit it ("unauthenticated"), so any reachable affected site may be a target.
Bricksforge is a commercial add-on for the Bricks visual site builder, adding features such as forms, animations and admin-area pages. Patchstack estimated it is used by roughly 6,000 websites.

Sites that do not run the Bricksforge plugin are outside the scope of this issue.

What to do

Update Bricksforge to 3.1.8.10 or later as soon as possible. Both Patchstack and The Hacker News point to version 3.1.8.10 as the fixed release.
Check whether your site uses the plugin. If Bricksforge is installed and the version is 3.1.8.9 or earlier, treat updating as urgent.
If you cannot update right away, consider whether the plugin can be temporarily disabled until you can, as a precaution — bearing in mind that this may change how your site behaves.
Consider malware screening afterwards. Because successful exploitation leads to code execution, security practitioners generally recommend reviewing a site for signs of compromise (unexpected files, admin users or modified code) after updating.
Watch Patchstack and vendor channels. Patchstack said it deployed a mitigation rule to protect its users; re-check advisories before relying on any summary, including this one.

Sources

SecurityWeek — reports that a critical Bricksforge flaw (CVE-2026-85097, cited as CVSS 9.8) is being exploited in the wild, that versions up to 3.1.8.9 are affected and 3.1.8.10 is the fix, and that around 6,000 sites use the plugin.
The Hacker News — reports that Patchstack observed exploitation starting 7 October 2026 at 9:47 p.m. UTC and describes the four-step path to remote code execution.
Patchstack — the disclosure behind much of the reporting, with the telemetry (first observed 7 October 2026, 21:47 UTC) and a mitigation rule for its users.