Hackers actively exploit maximum-severity flaw in Bricksforge WordPress plugin
in plain words
Bricksforge is an add-on tool for building WordPress websites. Security researchers found hackers are breaking into sites using a serious bug in it, tricking the system into running harmful code without needing a password. The plugin maker has released a fixed version, and site owners are told to update right away.
Patchstack reported active exploitation of CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in Bricksforge, a WordPress plugin billed as a toolkit for the Bricks website builder. The flaw allows unauthenticated attackers to upload and execute arbitrary PHP code, giving them remote code execution on vulnerable sites. It affects Bricksforge versions up to 3.1.8.9; the developer patched it in version 3.1.8.10, with 4.0.1 as the latest safe release.
According to Patchstack, the plugin checks a file's MIME type on initial upload but later trusts client-supplied metadata when a form is submitted, failing to validate the url field inside the temporaryFileUploads parameter. Attackers exploit this by requesting a nonce from the unauthenticated bricksforge_regenerate_nonce endpoint, uploading a GIF/PHP polyglot file that passes MIME checks, then submitting a form where the file field points to the validated image but the url field ends in a PHP extension. Wordfence described the same mechanism, noting the server places the uploaded file's contents at the PHP-named location, letting the embedded code execute when requested.
Patchstack first observed exploitation attempts on October 7, 2026, targeting either the Bricksforge REST API endpoint wp-json/bricksforge/v1/form_submit or the admin-ajax.php endpoint with the bricksforge_form_submit action. Attackers use alternate PHP extensions such as .php5, .php7 and .phtml, case variations, and encoded extensions to bypass filtering. Patchstack identified 63 unique source IP Internet Protocol The internet's basic rules for sending data, using numeric addresses for every connected device. Full definition of IP involved, with six accounting for about 46 percent of requests, and described two distinct clusters suggesting automated exploitation via proxies or distributed infrastructure, though it stopped short of attributing the activity to a specific actor.
Successful exploitation can let attackers take over a WordPress site, deploy web shells, access sensitive data, and maintain persistent access. Patchstack recommends site owners update immediately and audit requests to the affected endpoint for temporaryFileUploads parameters, repeated form submissions, and unexpected PHP files in the bricksforge tmp upload directory.
Separately, Patchstack noted ongoing abuse of cross-site scripting flaws in WPC Product Bundles for WooCommerce and Ninja Forms to deliver a payload that installs a backdoor plugin, creates hidden admin accounts, and sets up a magic login URL granting access as the site's original administrator.