Key points
- CVE-2026-85097 has a CVSS score of 10.0 and affects Bricksforge versions up to 3.1.8.9.
- Patchstack detected active exploitation attempts in the wild on 7 October 2026.
- A fix is available in Bricksforge version 3.1.8.10.
Security firm Patchstack confirmed that attackers are actively exploiting a maximum-severity flaw in the Bricksforge WordPress plugin. The vulnerability, identified as CVE-2026-85097, carries a CVSS score of 10.0 and enables unauthenticated remote code execution on affected websites.
The issue allows threat actors to upload and execute arbitrary PHP code without needing login credentials. This flaw impacts all versions of Bricksforge up to and including 3.1.8.9. Developers have released version 3.1.8.10 to address the security hole.
How the Exploit Works
The vulnerability stems from insufficient validation during form submissions. While the plugin correctly checks the MIME type of files upon initial upload, it fails to validate the 'url' field within the 'temporaryFileUploads' parameter later. Attackers exploit this gap by manipulating file metadata.
Wordfence described a four-step exploitation process. First, an attacker requests a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint. Next, they upload a GIF/PHP polyglot file, which passes the initial MIME check and lands in the temporary directory.
The attacker then submits a form where the file path points to the validated image, but the URL ends with a PHP extension. Bricksforge trusts this submitted metadata and moves the file contents to the PHP location. When the file is requested, the embedded code executes.
Who Is Affected
Bricksforge is marketed as a comprehensive tool for the Bricks visual website builder. It supports features such as animations, advanced forms, and scrolling video sequences. Any WordPress site using Bricksforge versions 3.1.8.9 or earlier is potentially vulnerable to this attack vector.
Patchstack detected the first exploitation efforts on 7 October 2026 at 9:47 p.m. UTC. The timing suggests that threat actors are moving quickly to leverage the flaw before site administrators can apply the necessary updates.
Our take on the response
The availability of a patch in version 3.1.8.10 provides a clear remediation path for site owners. However, the active nature of the exploitation means that delayed updates could result in compromised systems. Administrators should prioritise updating this plugin immediately.
Background: Threat actors
Threat actors in cybersecurity are individuals or groups who intentionally compromise systems to steal data, disrupt operations or extort money. They range from lone hackers to state-sponsored teams. Defending against them requires analysing behaviour, not just blocking known malicious files or IP addresses.
Read the full guide: Threat Actors in Cybersecurity: Tactics, Profiles and Detection Strategies
What to do and how to stay safe: Bricksforge
- Check your WordPress plugin list for Bricksforge and verify the installed version number.
- Update Bricksforge to version 3.1.8.10 or later as soon as possible to mitigate the risk.
- Monitor server logs for unusual file uploads or requests to the bricksforge_regenerate_nonce endpoint.
- Review temporary upload directories for any suspicious files with PHP extensions disguised as images.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the Bricksforge vulnerability?
The vulnerability CVE-2026-85097 has a CVSS score of 10.0, indicating maximum severity.
Which versions of Bricksforge are affected?
All versions up to and including 3.1.8.9 are affected by this remote code execution flaw.
Is there a fix available for this vulnerability?
Yes, a patch has been released in Bricksforge version 3.1.8.10.