A maximum-severity flaw in the Bricksforge plugin for WordPress, CVE-2026-85097 (CVSS 10.0), is being exploited in the wild, according to security firm Patchstack. It lets an unauthenticated attacker upload and run arbitrary PHP code on a vulnerable site. Patchstack first saw exploitation attempts on October 7, 2026, at 21:47 UTC.
The plugin checks a file’s type when it is first uploaded, but when a form is later submitted it trusts the file details sent by the browser, including a url field inside the temporaryFileUploads parameter. An attacker requests a valid nonce from an unauthenticated AJAX endpoint, uploads a GIF/PHP polyglot (a valid image that also contains PHP) and then submits a form whose url ends in a PHP extension, so the server writes the contents to a runnable .php file. Patchstack observed activity from 63 source IPs, including bursts of identical requests and attempts to dodge extension filters with variants such as .php5, .phtml, mixed case and URL-encoded extensions. It says the pattern points to automated exploitation and does not attribute it to a single actor. A successful attack lets the intruder take over the site, plant web shells, read sensitive data and keep persistent access.
How to check if you’re affected
Affected versions are Bricksforge 3.1.8.9 and earlier; the fix is in version 3.1.8.10, so update to that release or later from the WordPress plugins screen. If the plugin was installed before you patched, review web logs for requests to /wp-json/bricksforge/v1/form_submit or the bricksforge_form_submit action in /wp-admin/admin-ajax.php that carry a temporaryFileUploads parameter, and look for unexpected PHP files in /wp-content/uploads/bricksforge/tmp/. Patchstack lists six IPs that account for roughly 46% of requests: 177.75.57[.]20, 23.97.62[.]146, 84.247.60[.]125, 38.154.185[.]97, 150.109.16[.]166 and 153.75.90[.]146. If you find a stray PHP file, treat the site as compromised and rotate its credentials.