CVE-2026-85097: What the Bricksforge WordPress Exploitation Means for Your Business
目次
CVE-2026-85097 is a critical unauthenticated arbitrary file upload vulnerability in the Bricksforge plugin for WordPress, disclosed by Patchstack on October 8, 2026 with a CVSS score of 10.0, and the window between public exposure and active exploitation has already collapsed to zero because Patchstack telemetry recorded the first exploitation attempts at 21:47 UTC on October 7, 2026, the day before the public advisory was issued. Within 48 hours, Patchstack observed activity from 63 unique source IPs targeting the vulnerability, operating in automated clusters that suggest commodity exploitation infrastructure rather than targeted attacker research.
This short analysis covers what the vulnerability does, which Bricksforge versions are affected, how the exploitation chain works in practice, and what your business should do this week if your WordPress estate includes any site running the Bricksforge plugin.
What is CVE-2026-85097?
CVE-2026-85097 is an unauthenticated arbitrary file upload vulnerability affecting the Pro Forms module inside the Bricksforge plugin for WordPress, which is itself an extension to the Bricks visual website builder that adds animation, scrolling video, and advanced form features used primarily by design-focused agency teams and content studios. According to Patchstack’s analysis, the vulnerability stems from insufficient validation of a URL field in the temporaryFileUploads parameter during form submission, which lets an unauthenticated attacker upload a file disguised as a legitimate image and then trick the plugin into interpreting it as PHP code at a predictable path on the server.
The National Vulnerability Database classifies the underlying weakness as CWE-434, which covers unrestricted upload of files with dangerous types, and the practical effect is remote code execution at the privilege level of the PHP process on the WordPress server. Patchstack and the official CVE record both reflect maximum-severity ratings for this reason: a file upload bug that converts into arbitrary PHP execution produces the same operational outcome as a dedicated RCE vulnerability, regardless of how the underlying weakness is classified in a vulnerability taxonomy.
Which Bricksforge versions are affected by CVE-2026-85097?
CVE-2026-85097 affects Bricksforge versions up to and including 3.1.8.9, and if any part of your WordPress estate runs the Bricksforge plugin at or below that version, you should treat the installation as under active exploitation risk until it has been updated to a fixed release.
Patchstack and Bricksforge have published fixes in two parallel release lines. The 3.x branch is patched in version 3.1.8.10. The 4.x branch, released by Bricksforge on October 8, 2026, is tracked as version 4.0.1 and ships the fix in the new major release line. If your WordPress sites use managed updates through a hosting platform or a plugin update service, verify that the automatic update has been applied rather than queued, because the gap between update availability and update application is exactly the window attackers are now operating in.
Bricksforge is a commercial add-on used by approximately 6,000 websites, concentrated in agency-built WordPress sites, marketing microsites, and content-first business websites. If your business operates any of these as part of a broader digital footprint, the inventory question matters more than the plugin’s named user population because many Bricksforge deployments live inside sites your central IT team may not directly manage.
How does the exploitation chain work?
The chain is operationally simple, which is why exploitation scaled from first observation to 63 IPs within 48 hours.
Stage one is nonce acquisition and file upload. An unauthenticated attacker requests a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint, which Bricksforge exposes publicly for form processing, and then submits a crafted request to POST /wp-json/bricksforge/v1/form_submit with a payload containing a file disguised to pass the plugin’s initial MIME type validation. Bricksforge accepts the file into a predictable temporary directory under /wp-content/uploads/bricksforge/tmp/, which the attacker then references in the second stage.
Stage two is execution. The attacker triggers a secondary request that causes Bricksforge to place the file contents at a PHP-executable path inside the WordPress uploads directory, typically under /wp-content/uploads/2026/10/ with destination filenames matching the pattern login_admin_*.php. Once the file is written to that location, requesting it through a browser causes the webserver to interpret and execute the embedded PHP code, producing a webshell under the attacker’s control.
Patchstack’s telemetry showed two distinct automation patterns across the 63 source IPs it recorded. In the first cluster, 44 IP addresses sent 56 requests with identical payloads within seconds of one another. In the second cluster, three IP addresses systematically tested 25 variations of PHP file extensions and encodings against the same temporary file. Both patterns are consistent with distributed proxy infrastructure and automated scanning rather than targeted intrusion, which means CVE-2026-85097 has already graduated from a disclosed vulnerability into shared exploitation tradecraft.
What should your business do now?
Here is what we recommend to do in priority order, if any Bricksforge installation exists anywhere in your WordPress estate.
Update immediately to Bricksforge 3.1.8.10 or 4.0.1. The patch window measured in days that your organization probably treats as standard for WordPress plugin disclosures is already longer than the window attackers are operating in, and the automated exploitation Patchstack has observed will continue to scale across the exposed population until patching catches up.
Audit /wp-content/uploads/bricksforge/tmp/ and the surrounding uploads directories for suspicious PHP files. The Patchstack writeup specifically names login_admin_*.php as the destination filename pattern Bricksforge places at writable locations, so if your WordPress site holds files matching this pattern, your incident response should assume the site has been compromised and begin credential rotation and content integrity review.
Treat unmanaged WordPress estates as part of your attack surface. CybelAngel’s Attack Surface Management identifies the externally reachable WordPress sites inside your organization and your supply chain the way an attacker would discover them, including the agency-built sites and marketing microsites that often sit outside central IT visibility. 資格情報インテリジェンス surfaces the WordPress administrator credentials that appear on dark web and underground sources when compromised sites are harvested at scale.
Monitor your WordPress exposure now
著者について
