# Attackers Are Exploiting a CVSS 10.0 Bug in the Bricksforge WordPress Plugin (CVE-2026-85097)

> CVE-2026-85097 is a maximum-severity (CVSS 10.0) unauthenticated arbitrary-file-upload flaw in Bricksforge, a popular add-on for the Bricks WordPress builder, that leads to remote code execution. It is being exploited in the wild from October 7, 2026. Here is exactly how the attack works, why patching alone is not enough, and the defender’s checklist — patch to the latest release, hunt the indicators of compromise, and assume exposed sites may already be breached.

Source: https://playciso.com/blog/bricksforge-cve-2026-85097-cvss-10-wordpress-rce-exploited · Published: 2026-10-12 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html

---

A maximum-severity bug — **CVSS 10.0** — in a popular WordPress plugin is under active attack. **CVE-2026-85097** lets an **unauthenticated** attacker upload and run arbitrary PHP on any site using a vulnerable version of **Bricksforge**, the “Swiss Army knife” add-on for the Bricks visual builder. If you run it, update now and then go hunting — because patching does not undo a breach that already happened. _Curated from [The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html), with Patchstack and Wordfence telemetry. Defensive write-up for security leaders and the people who run the sites._ ## What’s broken Bricksforge adds animations, advanced forms and scroll-video sequences to Bricks-built WordPress sites. The flaw is a textbook **trust-the-client** mistake: the plugin validates a file’s **MIME type at upload time**, but later trusts client-supplied metadata — specifically, _it does not validate the url field inside the temporaryFileUploads parameter_. That gap turns a file-type check into an arbitrary write. ## How the attack works - Get a nonce. The unauthenticated bricksforge_regenerate_nonce AJAX endpoint hands out a valid nonce — no login needed. - Upload a polyglot. A GIF/PHP polyglot is uploaded to the temporary directory, where it passes the MIME check because it really does look like a GIF. - Point the write at a .php path. A form submission references the validated GIF in its file field while the url field ends in .php. - Code executes. The server writes the file contents to the .php location, and the embedded code runs the moment that path is requested — full remote code execution as the web server. ## It’s already being exploited This is not theoretical. Patchstack logged exploitation attempts starting **October 7, 2026 at 21:47 UTC**, from **63 unique source IPs**. Six IPs drove roughly 46% of the traffic; one cluster of **44 IPs** fired **56 identical-payload requests within seconds**, and another trio probed **25 different extension and encoding variants** — `.php5`, `.php7`, `.phtml`, case changes and URL-encoding — the signature of automated mass-exploitation tooling racing to beat patching. ## The defender’s checklist - Update immediately. Vulnerable: up to and including 3.1.8.9. Patched in 3.1.8.10; the vendor recommends moving to the latest release (4.0.1). Confirm against the changelog and update. - Hunt the traffic. Audit requests to /wp-json/bricksforge/v1/form_submit and /wp-admin/admin-ajax.php with the bricksforge_form_submit action that carry a temporaryFileUploads parameter, and look for repeated identical submissions. - Check the drop zone. Look in /wp-content/uploads/bricksforge/tmp/ for unexpected PHP files. - Assume breach if you were exposed. Patching closes the door; it does not evict anyone already inside. A site that ran a vulnerable version during the active-exploitation window should be treated as a possible compromise and investigated — web shells, new admin users, modified core files, outbound connections. ## The leadership takeaway A CVSS 10.0, unauthenticated, actively-exploited RCE in a third-party plugin is exactly the supply-chain exposure that lives outside most asset inventories: a marketing site, built on a page-builder, extended by an add-on nobody on the security team chose. The lesson isn’t “WordPress bad” — it’s that **every public web property needs an owner, a patch SLA, and a rehearsed response** for the day one of its plugins turns critical. If you want to pressure-test that muscle, our [War Room incident simulator](/warroom) runs the exact decisions this bug forces — isolate first or image first, when to disclose, who to call — and the free [CISO Readiness Scorecard](/scorecard) shows where your weakest response area is before an attacker finds it. _As of October 12, 2026. Details (including the exact fixed version) evolve — confirm against the vendor changelog, Patchstack and Wordfence advisories before acting. Investigate only systems you are authorized to administer._