A maximum severity security vulnerability affecting the Bricksforge plugin for WordPress is being actively exploited in the wild, according to cybersecurity researchers at Patchstack. The vulnerability, tracked as CVE 2026 85097 with a CVSS score of 10.0, allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, potentially leading to remote code execution (RCE). The issue impacts Bricksforge versions up to and including 3.1.8.9, while a security update has been released in version 3.1.8.10 to address the flaw. Bricksforge is a WordPress plugin designed to extend the capabilities of the Bricks visual website builder, offering features such as animations, advanced forms, and scrolling video sequences.
According to Patchstack, exploitation attempts targeting the vulnerability were detected on October 7, 2026, at 9:47 PM UTC. Researchers explained that the issue is linked to insufficient validation of file metadata during form submissions. While Bricksforge performs MIME type validation when a file is initially uploaded, the plugin later relies on client provided metadata during form processing without properly validating the URL field inside the temporaryFileUploads parameter. This security gap can allow attackers to manipulate file references and execute malicious PHP code on affected websites. Researchers explained that attackers can obtain a valid nonce through the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, upload a specially crafted GIF or PHP polyglot file that appears as an image, and then submit a form containing modified file information that points to a PHP extension. This process can result in execution of embedded code when the malicious file is accessed.
Security researchers said successful exploitation could allow attackers to gain control over affected WordPress websites, deploy web shells, access sensitive information, and maintain unauthorized access. Patchstack observed attackers targeting the Bricksforge REST API form submission endpoint and WordPress admin AJAX endpoint using specially crafted temporaryFileUploads parameters. Researchers noted that attackers have attempted to bypass extension filtering by using alternate PHP extensions, different letter casing formats, and encoded file extensions. Patchstack identified multiple exploitation patterns, including one group of 44 IP addresses sending 56 similar requests within seconds and another group of three IP addresses testing 25 variations of PHP extensions and encoding methods. Researchers stated that these activities indicate automated exploitation attempts through distributed infrastructure but do not attribute the activity to any specific threat actor. The exploitation activity was observed from 63 unique source IP addresses, with several addresses contributing a significant portion of detected requests.
Users running affected versions of Bricksforge are advised to update the plugin to the latest available release and review their websites for signs of unauthorized activity. Security teams have recommended monitoring requests involving the wp-json/bricksforge/v1/form_submit endpoint containing temporaryFileUploads parameters, reviewing repeated form submissions, and checking for unexpected PHP files within the wp-content/uploads/bricksforge/tmp directory. The disclosure comes alongside reports of exploitation attempts targeting vulnerabilities in other WordPress plugins, including WPC Product Bundles for WooCommerce and Ninja Forms. Researchers noted that while updating these plugins can prevent additional exploitation, existing compromises require separate investigation, including reviewing administrator accounts, database records, plugin directories, and server logs.
The issue highlights continued security challenges within the WordPress ecosystem, where vulnerable plugins can become targets for automated exploitation campaigns. According to Wordfence data, more than 2,000 WordPress related vulnerabilities were published during the second quarter of 2026, with an increase in high severity flaws compared with the previous quarter. Security researchers continue to recommend timely patching, strong website security controls, vulnerability monitoring, and regular scanning to identify suspicious activity. Website owners using WordPress plugins are encouraged to maintain updated software versions and apply security practices that reduce exposure to emerging threats.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
