A grave vulnerability in the Bricksforge plugin for WordPress is under active exploitation, enabling unauthenticated attackers to upload and execute arbitrary PHP code. The flaw, tracked as CVE-2026-85097 and rated CVSS 10.0, affects Bricksforge versions up to 3.1.8.9; version 3.1.8.10 resolves the issue. All sites running the plugin need immediate attention.
How the exploit works
The vulnerability arises from weak server-side validation during file and form submissions. While Bricksforge checks a file’s MIME type during upload, it later trusts metadata passed by the client. Attackers exploit this gap using the ‘temporaryFileUploads’ form parameter. Specifically, they provide a valid image file (like a GIF) for the “file” path, but supply a “url” that ends in a PHP extension. This allows placement of malicious code, which is then executed when accessed.
A typical chain of actions is: request a nonce via Bricksforge’s AJAX endpoint, upload a GIF/PHP polyglot file that passes MIME checks, then submit a form where the URL field ends in .php (or .php5, .phtml, etc.), allowing the server to treat the file as executable PHP. Attackers also use mixed casing (e.g. .PHP) and URL encoded extensions to get around filters.
Observed patterns and threat
Patchstack first spotted exploitation attempts on October 7, 2026. Two clusters of attacking IPs emerged: one with dozens of requests using identical payloads, another probing with variations in PHP extensions or encodings. So far, over 60 IPs have been tied to attacks; six of them account for nearly half of the observed traffic.
Targets include Bricksforge’s REST API form submission endpoint (“/wp-json/bricksforge/v1/form_submit”) and the legacy AJAX route (“/wp-admin/admin-ajax.php”) using the action “bricksforge_form_submit”. Malicious traffic is focused on specific crafted payloads using the ‘temporaryFileUploads’ field. Successful exploits can lead to full site takeover: remote code execution, web shells, data theft, and persistence.
Other WordPress plugins also under attack
Alongside Bricksforge, vulnerabilities in two other plugins — WPC Product Bundles for WooCommerce and Ninja Forms — are being abused to deliver a JavaScript payload (‘x.js’) that installs backdoor plugins, hidden admin accounts, and persistent access. While updating these plugins (to versions 8.6.7 for WPC Product Bundles and 3.15.4 for Ninja Forms) blocks fresh exploits, any existing compromise won’t disappear without manual cleanup: checking for covert admin accounts, examining must-use plugin directories, and reviewing server logs.
Wider WordPress risk landscape
A recent survey covering Q2 2026 reveals over 2,000 WordPress vulnerabilities were published; high-severity flaws increased 15.2% over the prior quarter to 182 total. In that period, approximately 573,000 WordPress sites were breached. The top five most-targeted vulnerabilities include issues in LiteSpeed Cache, WPGraphQL, and WooCommerce Payments, among others. Many attacks stem from IPs located in the U.S., Germany, Czechia, Australia, Ukraine, France, Norway, Brazil, and Switzerland.
What to do now: If you use Bricksforge, update to version 3.1.8.10 immediately. Audit any requests sent to the aforementioned endpoints that include the ‘temporaryFileUploads’ parameter. Watch for unusual PHP files in the plugin’s temporary upload directory. For other vulnerable plugins, ensure they are patched and check your site for signs of existing compromise.
This flaw underscores how even plugins designed for creative functionality—advanced forms, animations, video integrations—can pose critical risks if upload and metadata handling are misconfigured. Staying on top of updates, minimizing trust in client-supplied data, and auditing exposed endpoints are non-negotiable defenses.
