Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw for Unauthenticated RCE

Bricksforge Flaw Under Active Exploitation

Attackers are actively exploiting a maximum-severity vulnerability in the Bricksforge plugin for WordPress, according to Patchstack. The flaw, tracked as CVE-2026-85097 with a CVSS score of 10.0, allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable websites, resulting in remote code execution. It impacts Bricksforge versions up to and including 3.1.8.9, with patches released in version 3.1.8.10.

Patchstack detected exploitation efforts targeting the flaw on October 7, 2026, at 9:47 p.m. UTC. Bricksforge is advertised as a "Swiss Army knife" for Bricks, a visual website-building tool for WordPress, with support for animations, advanced forms, and scrolling video sequences. Users are advised to update to the latest version of the plugin (4.0.1) to mitigate the threat. Site owners are recommended to audit incoming requests to the "/wp-json/bricksforge/v1/form_submit" endpoint that contain a "temporaryFileUploads" parameter, as well as repeated form submissions and unexpected PHP files in "/wp-content/uploads/bricksforge/tmp/."

How the Exploitation Works

The vulnerability stems from insufficient validation of a URL field in the 'temporaryFileUploads' parameter during form submission. Bricksforge validates a file's MIME type when it is first uploaded, but when a form is later submitted, it trusts the file metadata the client sends and does not validate the 'url' field.

An attacker can exploit this in four steps: request a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint, upload a GIF/PHP polyglot that passes the MIME check, submit a form where the 'file' path points to the validated image but the 'url' ends in a PHP extension, and trigger execution of the embedded code when the file is requested. Wordfence noted that attackers use alternate PHP extensions such as .php5, .php7, or .phtml, case manipulation such as .PHP or .pHp, and encoded extensions to bypass extension filtering.

Observed attacks targeted the REST API form submission endpoint "/wp-json/bricksforge/v1/form_submit" or the "/wp-admin/admin-ajax.php" endpoint with the "bricksforge_form_submit" action. Patchstack recorded activity from 63 unique source IPs, with six accounting for roughly 46% of all requests. Two clusters stood out: 44 IPs sent 56 requests with identical payloads within seconds, and three IPs tested 25 variations of PHP extensions against the same temporary file, pointing to automated exploitation over rotating proxies.

Related Plugin Vulnerabilities

Threat actors are also abusing cross-site scripting flaws in WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS 7.1) and Ninja Forms (CVE-2026-94504, CVSS 7.1) to deliver a JavaScript payload called "x.js" that deploys a backdoor plugin and creates rogue admin accounts. The implant features an unauthenticated file manager, creates a hidden WordPress administrator, and installs a magic login URL. Updating to version 8.6.7 of WPC Product Bundles and 3.15.4 of Ninja Forms prevents further exploitation but does not remove existing infections.

WordPress Exploitation Trends

Wordfence data shows 2,073 WordPress-related vulnerabilities were published in the second quarter of 2026, with high-threat flaws rising 15.2% from the previous quarter to 182. About 573,000 WordPress sites were compromised during the period. The most targeted flaws included CVE-2024-28000 in LiteSpeed Cache, CVE-2019-9879 in WPGraphQL, CVE-2016-15042 in Frontend File Manager, CVE-2023-28121 in WooCommerce Payments, and CVE-2025-3102 in SureTriggers. The vast majority of attacking IPs originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.

Sources: The Hacker News