Bricksforge vulnerability exploited for remote code execution
The Bricksforge vulnerability tracked as CVE-2026-85097 is being actively exploited to run attacker-controlled code on WordPress websites, according to Patchstack telemetry. The flaw has a CVSS score of 10.0, the highest rating on the standard vulnerability severity scale. It affects Bricksforge versions up to and including 3.1.8.9 and is fixed in version 3.1.8.10. Patchstack first observed exploitation on October 7, 2026, at 21:47:17 UTC.
Bricksforge extends Bricks Builder, a visual website-building tool for WordPress. It adds advanced forms, animations, custom interactions, dynamic data management and backend customization. The vulnerable component can be reached without authentication, meaning an attacker does not need an account or password. The issue is an arbitrary file upload vulnerability, a weakness that lets an attacker place a file of their choice on the website. In this case, the uploaded file can lead to remote code execution (RCE), which means running commands or programs on the server from elsewhere.
The attack works because Bricksforge checks a file at one stage but trusts attacker-supplied information at a later stage. During the initial upload, the plugin validates the file's MIME type, a label describing whether the file is an image, document or another kind of content. When a form is subsequently submitted, however, it does not properly validate the url field inside the temporaryFileUploads parameter.
An attacker can first request a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint. A nonce is a short-lived value intended to show that a request is legitimate, while AJAX is a method websites use to exchange data without reloading the whole page. The attacker then uploads a GIF/PHP polyglot, a single file that qualifies as a GIF image but also contains PHP, the programming language commonly used to run WordPress. Because the file appears to be an image, it passes the MIME check and enters Bricksforge's temporary upload directory.
The attacker next submits a form in which the server-side file path still points to the approved image, while the supplied destination URL ends with a PHP extension. Bricksforge trusts that metadata and writes the file's contents to the PHP destination. Requesting the resulting file causes the server to execute its embedded code. Patchstack identified the relevant processing in bricksforge/includes/elements/pro-forms/actions/init.php and bricksforge/includes/elements/pro-forms/actions/base.php.
Successful exploitation gives the attacker arbitrary PHP execution. Patchstack says this access can be used to install web shells, which are malicious files that provide continuing remote control, alter website content, read sensitive information and maintain persistent access to the site.
All but one of the attempts captured by Patchstack targeted the Bricksforge REST API form-submission endpoint at POST /wp-json/bricksforge/v1/form_submit. A REST API is an interface through which software sends structured requests to another application. The remaining request used /wp-admin/admin-ajax.php with the bricksforge_form_submit action. Every request carried a manipulated temporaryFileUploads parameter.
The defining pattern was a mismatch between an image file path and a PHP destination. In 95% of captured requests, the server-side path ended in .gif or .png, while most of those requests paired it with a PHP-related destination URL. Most files were directed through /wp-content/uploads/bricksforge/tmp/. Some attempts used filenames matching login_admin_*.php and aimed to place them in ordinary WordPress upload folders, including /wp-content/uploads/2026/10/.
The attackers also varied their payloads to test possible ways around extension filters. Patchstack recorded .php, .php5, .php7, .php8, .phtml, .pht, .phtm and .phps, along with mixed-case forms such as .PHP, .Php, .pHp and .PHTML. Attempts included URL-encoded and double-encoded forms such as %2ephp, .%70hp and .%2570%2568%2570. Other requests changed or omitted the path, name, originalFilename and url fields to explore how the plugin handled incomplete or manipulated metadata.
Patchstack's telemetry shows signs of coordinated automation. One cluster involved 44 IP addresses sending 56 identical requests within seconds. Another involved three addresses testing 25 extension and encoding variations against the same temporary file. Patchstack said these patterns were consistent with automated activity using rotating proxies or distributed infrastructure, but were not enough to attribute the campaign to one threat actor.
In total, Patchstack recorded 63 unique source IP addresses. The six most active generated about 46% of all requests: 177.75.57.20 on EXPLORERNET, a Brazilian fixed-line ISP; 23.97.62.146 on Microsoft Azure; 84.247.60.125 on HostRoyale; 38.154.185.97 on B2 Net Solutions; 150.109.16.166 on Tencent; and 153.75.90.146 on Cloudzy. AbuseIPDB showed 8, more than 1,270, 12, 11, 185 and 35 reports for those addresses respectively. CleanTalk listed the HostRoyale, B2 Net Solutions, Tencent and Cloudzy addresses, but not the EXPLORERNET or Microsoft Azure addresses.
The infrastructure included datacenter systems, cloud services, VPN or proxy services and residential or fixed-line connections. Patchstack described 177.75.57.20, the most active address, as an outlier because it belonged to a Brazilian fixed-line ISP and had almost no previous abuse history.
Website owners and administrators should update Bricksforge to version 3.1.8.10 or later immediately. Logs should be checked for requests to the two form-submission endpoints, use of temporaryFileUploads, image paths paired with PHP destinations, repeated extension variations and calls to bricksforge_regenerate_nonce followed by an upload and form submission. Administrators should also look for unexpected PHP files in Bricksforge's temporary folder or other uploads directories, especially login_admin_*.php, and for requests made to newly created PHP files.
Sites that ran an affected version without protection require a historical review of their logs and hosting environment for unauthorized changes, unexplained application activity and unexpected PHP files. Patchstack says its RapidMitigate traffic rule for CVE-2026-85097 was active before the first observed attack and blocks the reported attempts without modifying plugin code, while monitoring continues for new payloads and bypasses. For owners who prefer not to manage WordPress infrastructure alone, AEU Hosting provides managed WordPress hosting secured end to end. Updating Bricksforge remains the direct fix for this vulnerability.