Attackers exploit Bricksforge flaw to breach WordPress websites

Hackers are actively exploiting a critical vulnerability in the Bricksforge WordPress plugin that allows outsiders to upload malicious files and execute code on affected websites without signing in, security researchers have warned.

The vulnerability, identified as CVE-2026-85097, affects Bricksforge versions up to and including 3.1.8.9. Security firm Patchstack has urged website administrators to install version 3.1.8.10 or later after detecting exploitation attempts beginning on 7 October.

Patchstack assigned the flaw the maximum severity score of 10.0 under its assessment, while the official CVE record maintained by Wordfence gives it a critical rating of 9.8 on the CVSS 3.1 scale. Both assessments identify a serious risk of remote code execution, potentially allowing an intruder to take control of a compromised website.

The plugin’s developer separately disclosed a security fix for its Pro Forms upload feature in version 4.0.1, released on 8 October. Its changelog states that the issue affects every website where Pro Forms is active, even where individual forms do not contain file-upload fields.

Patchstack said its monitoring systems first recorded attempted exploitation at 21:47 UTC on 7 October. Its analysis identified requests from 63 distinct internet protocol addresses, including clusters displaying signs of coordinated, automated activity. The company did not identify the operators behind the attacks or establish that they belonged to a single group.

One cluster involved 44 addresses sending 56 requests with identical payloads within seconds. Another involved three addresses testing 25 variations of file extensions and encoding against the same temporary file, suggesting attempts to evade controls designed to reject executable uploads.

The underlying weakness arises when Bricksforge processes files submitted through its form functionality. Although the software checks the type of a file during its initial upload, it subsequently trusts information supplied by the browser when handling that file as part of a form submission.

An attacker can exploit this discrepancy by uploading a file that appears to be a GIF image but also contains PHP instructions. During a subsequent form submission, manipulated metadata can cause the file to be saved with an executable PHP extension rather than its original image extension.

The official vulnerability record explains that an unauthenticated visitor can obtain a valid security token through a publicly accessible plugin function. That removes a potential barrier to launching the attack, which can proceed without a WordPress account or administrator privileges.

Successful exploitation can provide a route to installing a malicious web shell, reading sensitive information, altering website content or maintaining unauthorised access. Such consequences are possible outcomes of the vulnerability, rather than confirmation that every website targeted by the observed requests was compromised.

Patchstack found that almost all captured exploitation attempts targeted the plugin’s form submission interface through the WordPress REST API. Every observed request contained a manipulated temporaryFileUploads parameter, which governs how uploaded files are handled during form processing.

The researchers said 95 per cent of requests paired a server-side image filename ending in GIF or PNG with metadata pointing towards a PHP-related destination. Some attempted to place executable files in ordinary WordPress upload folders under names beginning with loginadmin.

Administrators operating affected installations have been advised to update promptly and examine access logs for suspicious submissions, unexpected PHP files in upload directories and attempts to visit newly created executable files. Sites exposed before being patched may require further inspection for unauthorised changes.

Patchstack said it had deployed a traffic-filtering rule designed to block exploitation attempts before observing the first attacks. That protection is an interim mitigation for installations unable to update immediately, not a substitute for applying the corrected plugin release.

The security company observed attackers experimenting with alternative PHP extensions, unusual capitalisation and encoded characters. It also identified requests in which file names and other submission fields were altered or omitted, indicating efforts to identify which combinations the vulnerable software would accept.

The addresses involved included cloud infrastructure, hosting services and residential connections. Patchstack said the six busiest addresses generated 46 per cent of the requests it observed. Such network information offers clues for defenders investigating suspicious activity but does not, by itself, prove who controlled the computers or whether an attempt succeeded.

Bricksforge extends the Bricks visual website builder with advanced forms, animation tools, dynamic content and administrative customisation. The developer’s 4.0.1 release notes say forms with upload fields continue to function after the security correction.