A maximum-severity security vulnerability in the Bricksforge WordPress plugin is being actively exploited, allowing unauthenticated attackers to upload and run malicious PHP code on vulnerable websites.
Tracked as CVE-2026-85097, the vulnerability has a CVSS score of 10.0, the highest possible severity rating. According to Patchstack, exploitation attempts were detected on October 7, 2026. The flaw affects Bricksforge versions up to and including 3.1.8.9, while version 3.1.8.10 contains a fix.
Bricksforge is a WordPress plugin designed to extend the Bricks visual website builder with features such as advanced forms, animations, and scrolling video sequences. The vulnerability stems from insufficient validation of file metadata during form submissions, allowing attackers to bypass file upload protections and execute arbitrary PHP code on the server.
Patchstack explained that the plugin checks a file’s MIME type during the initial upload but later trusts client-supplied metadata without properly validating the URL field in the temporaryFileUploads parameter. Attackers can exploit this weakness by uploading a specially crafted file that functions as both a valid image and a PHP payload, then manipulating the URL to point to a PHP file.
The attack can be carried out without authentication. Threat actors can obtain a valid nonce through an exposed AJAX endpoint, upload a malicious image file to the plugin’s temporary directory, and submit a form containing manipulated file metadata. When the resulting PHP file is accessed, the embedded code can execute on the server.
Successful exploitation could allow attackers to take control of affected WordPress websites, deploy web shells, steal sensitive information, modify website content, and maintain persistent access.
Patchstack observed attackers targeting the Bricksforge form submission endpoint at /wp-json/bricksforge/v1/form_submit and the WordPress admin-ajax.php endpoint using the bricksforge_form_submit action. The observed requests included mismatches between the uploaded image file and the URL supplied during form submission.
Attackers have also attempted to bypass extension filtering by using alternative PHP extensions such as .php5, .php7, and .phtml, as well as mixed-case and encoded extensions. Patchstack recorded activity from 63 unique source IP addresses, with two clusters of requests suggesting automated exploitation using rotating proxies or distributed infrastructure.
Website administrators should update Bricksforge to a patched version immediately. The reported fix is available in version 3.1.8.10, and administrators should verify the current supported release and install the latest version available for their environment.
Site owners should also review web server logs for suspicious requests targeting the form submission endpoints, inspect /wp-content/uploads/bricksforge/tmp/ for unexpected PHP files, and check for other signs of compromise. Updating the plugin alone will not remove malicious files or persistence mechanisms left behind by attackers.
The disclosure comes amid reports of attacks exploiting cross-site scripting vulnerabilities in WPC Product Bundles for WooCommerce and Ninja Forms. The flaws, tracked as CVE-2026-93836 and CVE-2026-94504, respectively, have reportedly been abused to deliver a JavaScript payload capable of installing a malicious plugin and creating rogue administrator accounts.
The malicious implant can reportedly exploit an authenticated WordPress administrator’s browser session to install a backdoor plugin, create additional administrator accounts, and establish hidden persistence mechanisms. The reported patched versions are 8.6.7 for WPC Product Bundles for WooCommerce and 3.15.4 for Ninja Forms.
Administrators should investigate possible infections even after updating these plugins. Recommended checks include reviewing administrator accounts directly in the database, inspecting the must-use plugins directory, and examining server logs for suspicious activity.
The incidents highlight the continuing security risks associated with vulnerable WordPress plugins. Wordfence reported that 2,073 WordPress-related vulnerabilities were published during the second quarter of 2026, while approximately 573,000 WordPress sites were compromised during the period.
Among the vulnerabilities reportedly targeted most frequently were flaws affecting LiteSpeed Cache, WPGraphQL, Frontend File Manager, WooCommerce Payments, and SureTriggers.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Security experts recommend promptly patching vulnerable plugins, deploying a web application firewall, scanning websites for malware and unauthorized changes, and monitoring login attempts and file modifications. For administrators of sites running Bricksforge, immediate patching and a thorough compromise assessment are particularly important while exploitation remains active.
