WordPress Bricksforge flaw is under active attack

WordPress sites running vulnerable versions of the Bricksforge plugin are being targeted through a critical flaw that can let an unauthenticated attacker run PHP code on the server, according to Patchstack. The vulnerability is tracked as CVE-2026-85097 and has a CVSS severity score of 10.0, the highest rating on that scale.

The issue affects Bricksforge versions up to and including 3.1.8.9. A fix was released in version 3.1.8.10, and users are advised to update to the latest version, 4.0.1. Bricksforge is a WordPress plugin built for the Bricks visual site-building tool, adding functions such as animations, advanced forms and scrolling video sequences. Because the bug can be exploited without logging in, exposed public websites are the main concern.

Patchstack said it detected exploitation attempts against CVE-2026-85097 on October 7, 2026 at 9:47 p.m. UTC. The flaw is a remote code execution issue, meaning an attacker can make a vulnerable website run attacker-supplied code. In this case, the code is PHP, the server-side scripting language widely used by WordPress. Successful exploitation could allow control of the WordPress site, deployment of web shells, access to sensitive data and persistence on the site.

The technical failure is in how Bricksforge handles uploaded files during form submission. Patchstack said the plugin checks a file's MIME type, which is a label describing what kind of file it appears to be, when the file is first uploaded. Later, when a form is submitted, the plugin trusts metadata sent by the client, including the url field inside the temporaryFileUploads parameter. That creates a gap between the file that was validated and the location where the content can later be placed.

The reported attack path has four parts. An attacker first requests a valid nonce, a short-lived value used by WordPress to help verify requests, from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint. The attacker then uploads a GIF/PHP polyglot, a file that is valid as an image but also contains PHP code, so it passes the initial image check and lands in the temporary upload directory. Next, the attacker submits a form where the file path points to that validated image, while the URL ends with a PHP extension. Bricksforge then trusts the submitted metadata and writes the file content to a PHP location, where the embedded code can run when requested.

Wordfence described the same mismatch in its advisory. According to Wordfence, attackers can submit a crafted temporaryFileUploads parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with .php. The activity has also used cases where the file argument is a GIF or PNG while the URL points to a PHP payload.

Patchstack observed requests aimed at the Bricksforge REST API form submission endpoint, /wp-json/bricksforge/v1/form_submit, and at /wp-admin/admin-ajax.php using the bricksforge_form_submit action. The crafted temporaryFileUploads parameter contained a field name, a file path under /wp-content/uploads/bricksforge/tmp/, a URL ending in a PHP-like extension and a type such as image/gif. Attackers also tried to bypass extension filtering with alternate PHP extensions such as .php5, .php7 and .phtml, mixed-case variants such as .PHP, .Php and .pHp, and encoded forms such as .%70hp, %2ephp and .%2570%2568%2570.

Patchstack said two clusters were visible in its telemetry. In one cluster, 44 IP addresses sent 56 requests with identical payloads within seconds. In another, three IP addresses tested 25 PHP extension and encoding variations against the same temporary file. Patchstack said those patterns point to automated exploitation over rotating proxies or distributed infrastructure, but do not by themselves identify a single threat actor. The activity was recorded from 63 unique source IP addresses, with six accounting for roughly 46% of all requests: 177.75.57[.]20, 23.97.62[.]146, 84.247.60[.]125, 38.154.185[.]97, 150.109.16[.]166 and 153.75.90[.]146.

For website owners and hosting teams, the immediate action is to update Bricksforge. Sites should also be checked for signs that exploitation already happened, especially because patching blocks new attempts but does not automatically remove malicious files that may already have been created. Patchstack recommends auditing incoming requests to /wp-json/bricksforge/v1/form_submit that include temporaryFileUploads, looking for repeated form submissions, and checking for unexpected PHP files in /wp-content/uploads/bricksforge/tmp/.

The Bricksforge issue is not the only WordPress exploitation activity described by Patchstack. Attackers are also abusing cross-site scripting, known as XSS, in two unrelated plugins: WPC Product Bundles for WooCommerce, tracked as CVE-2026-93836 with a CVSS score of 7.1, and Ninja Forms, tracked as CVE-2026-94504 with a CVSS score of 7.1. XSS means malicious script runs in a victim's browser, often by abusing trust in a legitimate website or admin session.

In those attacks, Patchstack said a JavaScript payload named x.js can deploy a backdoor plugin and create rogue administrator accounts. The malicious plugin includes an unauthenticated file manager reachable through a direct request to the plugin's main PHP file. It also creates a WordPress administrator hidden from the Users screen and installs a magic login URL that authenticates the holder as the site's oldest administrator. Patchstack described it as a WordPress post-exploitation and persistence implant that runs inside the browser of a logged-in administrator and abuses that authenticated wp-admin session.

Updating the affected plugins stops further exploitation of those specific XSS vulnerabilities, according to the reported guidance, but it does not remove an existing infection. The relevant fixed versions are 8.6.7 for WPC Product Bundles for WooCommerce and 3.15.4 for Ninja Forms. Site owners are advised to check for hidden administrators by querying the database directly, inspect the must-use plugin directory and review web server logs.

Wordfence also reported wider WordPress exploitation trends for the second quarter of 2026. It said 2,073 WordPress-related vulnerabilities were published during the quarter, while high-threat flaws rose 15.2% from the previous quarter to 182. Wordfence also said about 573,000 WordPress sites were compromised during that period. The five most targeted vulnerabilities it listed were CVE-2024-28000 in LiteSpeed Cache versions up to 6.3.0.1, CVE-2019-9879 in WPGraphQL versions up to 0.2.3, CVE-2016-15042 in Frontend File Manager before 4.0 and N-Media Post Front-end Form before 1.1, CVE-2023-28121 in WooCommerce Payments 4.8.0 to 5.6.1, and CVE-2025-3102 in SureTriggers up to 1.0.78. Wordfence said the largest share of attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland and Brazil.