Active Exploitation Targets Critical Bricksforge WordPress RCE Flaw
Attackers are actively exploiting CVE-2026-85097, a maximum-severity vulnerability in the Bricksforge plugin for WordPress. The flaw carries a CVSS score of 10.0 and allows an unauthenticated attacker to upload and execute arbitrary PHP code, resulting in remote code execution on affected sites.
Bricksforge versions up to and including 3.1.8.9 are affected. The vendor addressed the issue in version 3.1.8.10, and site owners are advised to move to the latest available release, version 4.0.1. Bricksforge is a plugin for the Bricks visual website-building tool, offering functions including animations, advanced forms and scrolling video sequences.
How the Bricksforge flaw is exploited
Patchstack detected exploitation attempts on October 7, 2026, at 9:47 p.m. UTC. The issue lies in the handling of the temporaryFileUploads parameter during form submission. Bricksforge validates a file’s MIME type at upload, but later trusts file metadata supplied by the client and does not validate the url field.
An attacker can request a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot that passes the initial image MIME-type check. In the subsequent form request, the server-side file path can point to that validated GIF while the attacker-controlled URL ends in a PHP extension. This mismatch can cause the embedded PHP content to be written to an executable location.
Patchstack observed requests directed at the Bricksforge REST API endpoint /wp-json/bricksforge/v1/form_submit and the WordPress AJAX endpoint using the bricksforge_form_submit action. Wordfence noted attempts to bypass extension filtering with alternatives such as .php5, .php7 and .phtml, mixed-case extensions, and encoded extensions.
Observed activity and defensive checks
Patchstack recorded activity from 63 unique source IP addresses. One telemetry cluster involved 44 IPs sending 56 identical requests within seconds; another involved three IPs testing 25 PHP-extension and encoding variations against the same temporary file. Patchstack said the patterns indicate automated exploitation through rotating proxies or distributed infrastructure, but do not attribute it to one actor.
A successful compromise can give an attacker the ability to execute arbitrary PHP on the server, take control of a WordPress site, deploy web shells, access sensitive data and retain access. Updating is therefore only the first response step for sites that may already have been exposed.
Teams should update Bricksforge, review incoming requests to /wp-json/bricksforge/v1/form_submit containing temporaryFileUploads, and investigate repeated form submissions. They should also check for unexpected PHP files under /wp-content/uploads/bricksforge/tmp/. For businesses running WordPress forms, these checks provide a practical way to combine immediate patching with evidence gathering for possible compromise.