bricksforge-wordpress-cve-2026-85097-exploited
Active exploitation of a critical vulnerability in the Bricksforge WordPress plugin is allowing unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable sites, according to vulnerability research organization Patchstack. The flaw, tracked as CVE-2026-85097, affects Bricksforge versions up to and including 3.1.8.9 and is fixed in version 3.1.8.10.
Key Points
- Patchstack reported active attacks exploiting a critical Bricksforge plugin vulnerability that enables remote code execution on WordPress sites.
- The issue affects Bricksforge versions up to and including 3.1.8.9, with a vendor fix available in version 3.1.8.10.
- Attackers are abusing Bricksforge form submission endpoints and crafted file metadata to plant executable PHP files in WordPress upload directories.
- Patchstack telemetry shows at least 63 distinct source IP addresses and patterns consistent with automated exploitation using distributed infrastructure.
- Site owners are advised to update Bricksforge, apply traffic-layer mitigations where possible, and review logs and file systems for signs of compromise.
How the Bricksforge vulnerability works
Bricksforge is a plugin that extends the Bricks Builder page builder for WordPress, adding features such as advanced forms, animations, custom interactions, dynamic data handling, and backend customization, according to Patchstack. The vulnerability arises in the way Bricksforge processes file uploads associated with its form functionality.
Patchstack reported that Bricksforge validates a file’s MIME type during the initial upload step, but later trusts client-supplied metadata during form submission. Specifically, the plugin does not validate the url field inside the temporaryFileUploads parameter, allowing attackers to manipulate where the uploaded content is ultimately written.
According to Patchstack, the observed exploitation chain typically proceeds in four stages. First, an attacker requests a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint. Second, they upload a GIF/PHP polyglot file to the temporary upload directory, which passes MIME checks as an image while containing embedded PHP code.
In the third stage, the attacker submits a form that references the validated image file path but supplies a destination URL ending in a PHP extension. Finally, Patchstack said Bricksforge trusts the supplied metadata, writes the file contents to the PHP destination in the WordPress uploads directory, and the attacker can then trigger the embedded PHP code via a follow-up HTTP request.
Patchstack identified the key code paths as bricksforge/includes/elements/pro-forms/actions/init.php, where the metadata from temporaryFileUploads is injected, and bricksforge/includes/elements/pro-forms/actions/base.php, where the arbitrary file write occurs. Successful exploitation can give attackers remote code execution on the affected site, enabling deployment of web shells, modification of site content, access to sensitive data, and establishment of persistent footholds.
Attack patterns and infrastructure
Patchstack said it first recorded exploitation attempts against CVE-2026-85097 on October 7, 2026, at 21:47 UTC. The organization also stated that its RapidMitigate traffic-layer rule for this vulnerability was live before the first attack it observed.
Nearly all captured malicious requests targeted the Bricksforge REST API form submission endpoint /wp-json/bricksforge/v1/form_submit, according to Patchstack. One additional request used the legacy administrative endpoint /wp-admin/admin-ajax.php with the bricksforge_form_submit action. Every request described by Patchstack included a crafted temporaryFileUploads parameter.
Patchstack reported that in 95% of the recorded attempts, the server-side file path ended in .gif or .png; most of those requests paired the image path with a PHP-related destination URL. Many payloads referenced files under /wp-content/uploads/bricksforge/tmp/. Some used destination filenames matching patterns such as login_admin_*.php within date-based subdirectories like /wp-content/uploads/2026/10/.
To bypass extension filters, attackers tested a wide variety of extensions and encodings. According to Patchstack, these included alternative extensions such as .php, .php5, .php7, .php8, .phtml, .pht, .phtm, and .phps; case variations such as .PHP, .Php, .pHp, and .PHTML; encoded forms such as %2ephp, .%70hp, and .%2570%2568%2570; and altered or missing path, name, originalFilename, and url fields in the upload metadata.
Patchstack’s telemetry recorded 63 unique source IP addresses involved in the exploitation activity. The six most active addresses accounted for about 46% of all requests, according to the organization.
The company described two notable clusters among the observed traffic. One cluster consisted of 44 IP addresses that sent 56 identical requests within seconds of one another, which Patchstack said was consistent with distributed or rotating infrastructure. Another cluster involved three IP addresses that tested 25 different PHP extension and encoding combinations against the same temporary file, suggesting systematic probing for filter weaknesses.
Patchstack characterized the source infrastructure as a mix of datacenter hosts, cloud provider instances, VPN and proxy services, and residential or fixed-line ISP connections. The most active single IP address, 177.75.57.20, was associated with a Brazilian fixed-line ISP and had almost no prior abuse history in Patchstack’s data, which the organization noted as unusual compared with typical datacenter-based attack sources.
Detection and mitigation guidance
Patchstack advised site owners running Bricksforge to update the plugin to version 3.1.8.10 or later as the primary remediation for CVE-2026-85097. For environments where immediate updating is not possible, Patchstack stated that its RapidMitigate rule can block known exploit attempts at the HTTP traffic layer without requiring changes to plugin code.
The organization recommended that administrators review HTTP and application logs for a set of specific indicators. These include requests to /wp-json/bricksforge/v1/form_submit containing a temporaryFileUploads parameter, image paths such as .gif or .png paired with PHP-related destination URLs, and sequences where calls to bricksforge_regenerate_nonce are followed by file uploads and form submissions.
Patchstack also suggested looking for repeated form submissions that cycle through different file extensions, encodings, or capitalization patterns, which may indicate automated exploitation attempts. On the filesystem, administrators should check for unexpected PHP files in /wp-content/uploads/bricksforge/tmp/ and other uploads directories, particularly files with names following the login_admin_*.php pattern, and correlate these with any HTTP requests to newly created PHP files under upload paths.
For sites that previously ran a vulnerable Bricksforge version without protection in place, Patchstack recommended historical log analysis and host-level inspection. The organization said administrators should search for unrecognized PHP files, unusual application behavior, and unauthorized content or configuration changes that may signal successful compromise stemming from exploitation of CVE-2026-85097.
Sources
About the Author
