Critical Zero-Day Exploit Targets Bricksforge WordPress Plugin (CVE-2026-85097) Attackers are actively exploiting a severe vulnerability in the Bricksforge WordPress plugin, tracked as CVE-2026-85097, allowing unauthenticated remote code execution (RCE). The flaw, assigned a CVSS score of 10.0, enables threat actors to upload and execute arbitrary PHP code on affected websites without requiring login credentials. The vulnerability impacts Bricksforge versions up to and including 3.1.8.9, with the fixed release (3.1.8.10) issued to address the issue. Bricksforge, an extension for Bricks Builder, enhances WordPress sites with advanced forms, animations, and dynamic data tools its file upload functionality is the primary attack vector. ### Exploitation Mechanics According to Patchstack’s technical analysis, the flaw stems from insufficient validation in the plugin’s form upload process. While Bricksforge initially checks a file’s MIME type to verify it as an allowed image (e.g., GIF/PNG), it later trusts user-supplied file details without revalidating the URL field in `temporaryFileUploads`. Attackers bypass security by: 1. Uploading a file disguised as an image (e.g., a GIF with embedded PHP code). 2. Submitting a crafted form that pairs the image’s server path with a malicious PHP destination URL. 3. Triggering code execution when the server processes the file. Once exploited, attackers can deploy web shells, alter website content, exfiltrate sensitive data, or maintain persistent access. The attack also leverages the `bricksforge_regenerate_nonce` AJAX action to obtain valid request tokens. ### Attack Patterns & Observations Patchstack detected exploitation attempts beginning October 7, 2026 (21:47:17 UTC), with nearly all requests targeting: - `/wp-json/bricksforge/v1/form_submit` (primary endpoint). - `/wp-admin/admin-ajax.php` (via `bricksforge_form_submit` action). Key findings include: - 95% of requests used `.gif` or `.png` extensions in the server path, paired with PHP destination URLs (e.g., `.php5`, `.php8`, `.phtml`). - Attackers tested mixed capitalization, encoded filenames, and attempts to place malicious files (e.g., `login_admin_*.php`) outside temporary directories. - 63 unique source IPs were recorded, with automated, distributed activity including one cluster of 44 IPs sending 56 identical requests within seconds and another testing 25 extension/encoding variations. ### Vendor Response & Mitigation Bricksforge released version 3.1.8.10 to patch the flaw, with an additional security fix for Pro Forms uploads in version 4.0.1 (October 8, 2026). Administrators are urged to: - Update immediately to the latest version, even if active forms lack upload fields. - Review logs for suspicious `temporaryFileUploads` submissions. - Inspect upload directories (e.g., `/wp-content/uploads/bricksforge/tmp/`) for unexpected PHP files. - Monitor for unauthorized script execution or website changes. Patchstack’s RapidMitigate rule provides temporary protection for sites unable to update immediately, though a compromise review is recommended for previously exposed installations. This incident underscores the risks of unsafe file handling in WordPress plugins, where upload features can be weaponized for RCE.