Critical Bricksforge Vulnerability Under Active Attack
A severe critical vulnerability has been unequivocally identified within the WordPress ecosystem. Malicious actors are currently attempting to exploit this flaw to surreptitiously upload executable PHP files, entirely bypassing the need for password authentication. This perilous vulnerability resides deep within the architecture of the Bricksforge plugin. Cybersecurity analysts at Patchstack have assigned this threat a maximum severity rating of 10.
The Mechanics of CVE-2026-85097
The vulnerability, formally designated as CVE-2026-85097, directly impacts Bricksforge version 3.1.8.9 and all preceding iterations. The diligent development team successfully remediated the underlying issue with the release of version 3.1.8.10. Fundamentally, Bricksforge serves to augment the capabilities of the visual Bricks Builder, integrating sophisticated forms, fluid animations, and highly interactive elements into the platform.
The root cause of this catastrophic failure stems from the improper handling of the temporaryFileUploads parameter. During the initial upload phase, Bricksforge correctly validates the MIME type. However, it subsequently places unwarranted trust in the file path specifically provided by the user’s browser. Consequently, an attacker can deliberately engineer a critical mismatch between the previously validated content and the ultimate filename.
The assailant initially procures a cryptographic nonce by exploiting an unauthenticated AJAX handler. Subsequently, they dispatch a hybrid GIF file deeply embedded with malicious PHP code. The initial validation mechanism erroneously recognizes the payload as a permissible image format. The attacker then manipulates the URL within the metadata, cunningly appending a PHP extension to the destination address. As a direct result, the server inadvertently stores the image’s payload as a fully executable script.
To execute the final phase of the intrusion, attackers predominantly leverage the REST API endpoint situated at /wp-json/bricksforge/v1/form_submit. Executing the clandestinely uploaded PHP file grants the assailant the terrifying ability to run arbitrary server commands, deploy insidious web shells, and unilaterally alter the website’s core content. Crucially, successful exploitation demands absolutely no authenticated WordPress account.
Analysis of the Exploitation Campaign
Patchstack initially detected active exploitation attempts on October 7, 2026, at precisely 21:47 UTC. Security specialists meticulously recorded malicious requests originating from 63 distinct IP addresses. One highly coordinated cluster, comprising 44 addresses, simultaneously unleashed 56 identical requests within a span of mere seconds. Concurrently, three disparate addresses systematically tested 25 distinct variations of PHP extensions and complex encoding methodologies.
In an astonishing 95% of the intercepted requests, the source file path innocuously terminated in .gif or .png, while the ultimate destination address blatantly pointed toward a PHP script. Analysts encountered extensions such as .php5, .phtml, diverse case variations, and obfuscated encoded characters. Specific, highly targeted attempts aimed to generate files named login_admin_*.php directly within the standard WordPress uploads directory.
Patchstack has comprehensively documented the intricate mechanics of this attack and officially announced the deployment of their RapidMitigate defensive rule. However, it is crucial to understand that the sheer volume of requests and the number of originating IP addresses do not directly equate to the total number of successfully compromised websites. While the official CVE registry assigned the vulnerability a 9.8 score, Patchstack deemed the threat severe enough to warrant a perfect 10.
Administrators are vehemently urged to immediately upgrade to Bricksforge version 3.1.8.10 or a more recent iteration. If a website previously operated upon a vulnerable build, administrators must rigorously audit the request logs pertaining to the form submission handler, meticulously scour the uploads directory, and actively search for any recently introduced PHP files. Notably, similar malicious campaigns have previously targeted prominent plugins like Elementor Pro and Super Forms, where perilous file uploads invariably paved the way for catastrophic remote code execution.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
