---
id: "a237fa0f-4a84-4d23-95ee-8293d6ca2fbf"
kind: "link"
title: "Hackers actively exploit maximum-severity flaw in Bricksforge WordPress plugin"
language: "en"
section: "security"
date: "2026-10-12T09:44:44Z"
updated: "2026-10-12T09:44:44Z"
canonical: "https://tldlog.com/l/hackers-actively-exploit-maximum-severity-flaw-bricksforge/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/hackers-explotan-activamente-falla-critica-plugin/"
  de: "https://tldlog.com/de/l/hacker-nutzen-kritische-schwachstelle-wordpress-plugin/"
  fr: "https://tldlog.com/fr/l/pirates-exploitent-faille-critique-plugin-wordpress/"
  it: "https://tldlog.com/it/l/hacker-sfruttano-attivamente-falla-critica-plugin-wordpress/"
  pt-BR: "https://tldlog.com/pt/l/hackers-exploram-ativamente-falha-critica-plugin-bricksforge/"
  ru: "https://tldlog.com/ru/l/khakery-aktivno-ekspluatiruyut-kriticheskuyu-uyazvimost/"
  zh-Hans: "https://tldlog.com/zh/l/bricksforge-loudong-bei-liyong/"
source:
  name: "thehackernews.com"
  url: "https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html?m=1"
  language: "en"
  date: "2026-10-08T12:40:00Z"
---

# Hackers actively exploit maximum-severity flaw in Bricksforge WordPress plugin

## in plain words

Bricksforge is an add-on tool for building WordPress websites. Security researchers found hackers are breaking into sites using a serious bug in it, tricking the system into running harmful code without needing a password. The plugin maker has released a fixed version, and site owners are told to update right away.

Patchstack reported active exploitation of CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in Bricksforge, a WordPress plugin billed as a toolkit for the Bricks website builder. The flaw allows unauthenticated attackers to upload and execute arbitrary PHP code, giving them remote code execution on vulnerable sites. It affects Bricksforge versions up to 3.1.8.9; the developer patched it in version 3.1.8.10, with 4.0.1 as the latest safe release.

According to Patchstack, the plugin checks a file's MIME type on initial upload but later trusts client-supplied metadata when a form is submitted, failing to validate the url field inside the temporaryFileUploads parameter. Attackers exploit this by requesting a nonce from the unauthenticated bricksforge\_regenerate\_nonce endpoint, uploading a GIF/PHP polyglot file that passes MIME checks, then submitting a form where the file field points to the validated image but the url field ends in a PHP extension. Wordfence described the same mechanism, noting the server places the uploaded file's contents at the PHP-named location, letting the embedded code execute when requested.

Patchstack first observed exploitation attempts on October 7, 2026, targeting either the Bricksforge REST API endpoint wp-json/bricksforge/v1/form\_submit or the admin-ajax.php endpoint with the bricksforge\_form\_submit action. Attackers use alternate PHP extensions such as .php5, .php7 and .phtml, case variations, and encoded extensions to bypass filtering. Patchstack identified 63 unique source IPs involved, with six accounting for about 46 percent of requests, and described two distinct clusters suggesting automated exploitation via proxies or distributed infrastructure, though it stopped short of attributing the activity to a specific actor.

Successful exploitation can let attackers take over a WordPress site, deploy web shells, access sensitive data, and maintain persistent access. Patchstack recommends site owners update immediately and audit requests to the affected endpoint for temporaryFileUploads parameters, repeated form submissions, and unexpected PHP files in the bricksforge tmp upload directory.

Separately, Patchstack noted ongoing abuse of cross-site scripting flaws in WPC Product Bundles for WooCommerce and Ninja Forms to deliver a payload that installs a backdoor plugin, creates hidden admin accounts, and sets up a magic login URL granting access as the site's original administrator.

Source: [thehackernews.com](https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html?m=1)

## also covered by

- [patchstack.com](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/) (in English)