Attackers are exploiting a maximum-severity flaw in the Bricksforge WordPress plugin that lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable websites. The flaw, tracked as CVE-2026-85097 and scored 10.0, affects Bricksforge versions up to and including 3.1.8.9, and is fixed in 3.1.8.10, with version 4.0.2 adding further security hardening. Patchstack says it detected exploitation attempts from 7 October 2026 at 21:47 UTC, the day before public disclosure, from 63 unique IP addresses, and that roughly 6,000 websites use the plugin.

How the attack works

Bricksforge validates a file's MIME type when it is first uploaded, but when a form is later submitted it trusts the file metadata the client's browser sends, and does not validate the url field inside the temporaryFileUploads parameter. Attackers request a valid nonce from an unauthenticated AJAX endpoint, upload a GIF/PHP polyglot that passes the image check, then submit a form whose file path points to that image but whose url ends in a PHP extension, so the server writes executable code to a PHP location.

What site owners must do

Site owners should update to at least 4.0.1, which closes both disclosed upload issues, and preferably to 4.0.2. Updating stops new attacks but does not remove a backdoor already planted, so owners should also check upload directories for unexpected PHP files and review access logs for POST requests to the Bricksforge form endpoint since 7 October. Sites running the Bricks theme without Bricksforge are not affected by this CVE.