Attackers Are Exploiting a CVSS 10.0 Bug in the Bricksforge WordPress Plugin (CVE-2026-85097)

A maximum-severity bug — CVSS 10.0 — in a popular WordPress plugin is under active attack. CVE-2026-85097 lets an unauthenticated attacker upload and run arbitrary PHP on any site using a vulnerable version of Bricksforge, the “Swiss Army knife” add-on for the Bricks visual builder. If you run it, update now and then go hunting — because patching does not undo a breach that already happened.

Curated from The Hacker News, with Patchstack and Wordfence telemetry. Defensive write-up for security leaders and the people who run the sites.

What’s broken

Bricksforge adds animations, advanced forms and scroll-video sequences to Bricks-built WordPress sites. The flaw is a textbook trust-the-client mistake: the plugin validates a file’s MIME type at upload time, but later trusts client-supplied metadata — specifically, it does not validate the url field inside the temporaryFileUploads parameter. That gap turns a file-type check into an arbitrary write.

How the attack works

1. Get a nonce. The unauthenticated bricksforge_regenerate_nonce AJAX endpoint hands out a valid nonce — no login needed.
2. Upload a polyglot. A GIF/PHP polyglot is uploaded to the temporary directory, where it passes the MIME check because it really does look like a GIF.
3. Point the write at a .php path. A form submission references the validated GIF in its file field while the url field ends in .php.
4. Code executes. The server writes the file contents to the .php location, and the embedded code runs the moment that path is requested — full remote code execution as the web server.

It’s already being exploited

This is not theoretical. Patchstack logged exploitation attempts starting October 7, 2026 at 21:47 UTC, from 63 unique source IPs. Six IPs drove roughly 46% of the traffic; one cluster of 44 IPs fired 56 identical-payload requests within seconds, and another trio probed 25 different extension and encoding variants — .php5, .php7, .phtml, case changes and URL-encoding — the signature of automated mass-exploitation tooling racing to beat patching.

The defender’s checklist

• Update immediately. Vulnerable: up to and including 3.1.8.9. Patched in 3.1.8.10; the vendor recommends moving to the latest release (4.0.1). Confirm against the changelog and update.
• Hunt the traffic. Audit requests to /wp-json/bricksforge/v1/form_submit and /wp-admin/admin-ajax.php with the bricksforge_form_submit action that carry a temporaryFileUploads parameter, and look for repeated identical submissions.
• Check the drop zone. Look in /wp-content/uploads/bricksforge/tmp/ for unexpected PHP files.
• Assume breach if you were exposed. Patching closes the door; it does not evict anyone already inside. A site that ran a vulnerable version during the active-exploitation window should be treated as a possible compromise and investigated — web shells, new admin users, modified core files, outbound connections.

The leadership takeaway

A CVSS 10.0, unauthenticated, actively-exploited RCE in a third-party plugin is exactly the supply-chain exposure that lives outside most asset inventories: a marketing site, built on a page-builder, extended by an add-on nobody on the security team chose. The lesson isn’t “WordPress bad” — it’s that every public web property needs an owner, a patch SLA, and a rehearsed response for the day one of its plugins turns critical. If you want to pressure-test that muscle, our War Room incident simulator runs the exact decisions this bug forces — isolate first or image first, when to disclose, who to call — and the free CISO Readiness Scorecard shows where your weakest response area is before an attacker finds it.

As of October 12, 2026. Details (including the exact fixed version) evolve — confirm against the vendor changelog, Patchstack and Wordfence advisories before acting. Investigate only systems you are authorized to administer.