Add Techlomedia as a Preferred Source on Google
A severe security vulnerability has been uncovered in the Bricksforge plugin designed for WordPress, which is currently being exploited by malicious actors.
This flaw permits unauthorized uploads of harmful files and execution of arbitrary PHP code on compromised websites, without requiring authentication.
Officially designated as CVE-2026-85097, it carries a Critical Vulnerability Scoring System (CVSS) score of 10.0, marking it as a critical threat.
WordPress security firm Patchstack reported that it detected exploitation attempts starting on October 7, 2026.
This vulnerability impacts all versions of Bricksforge up to and including 3.1.8.9. Consequently, website administrators are urged to promptly update to a secured version of the plugin.
Bricksforge serves as an extension for Bricks, a visual website builder for WordPress, featuring tools such as advanced forms, animations, and scrolling video sequences.
The gravity of the vulnerability escalates due to the fact that attackers can exploit it without a user account or login information.
The roots of the flaw lie in the manner Bricksforge processes temporary file uploads throughout form submissions.
Although the plugin verifies a file’s MIME type during the upload, it fails to adequately authenticate the URL presented via the temporaryFileUploads parameter later in the process.
Exploiting this flaw, a potential attacker can upload a file designed to masquerade as a legitimate GIF or PNG image, while simultaneously containing PHP code.
This file successfully passes the initial MIME-type validation and is stored in the plugin’s temporary upload directory.
Next, the intruder submits a form with altered file metadata. While the file path directs to the purported image, the corresponding URL points to a PHP file.
Bricksforge then erroneously trusts the supplied URL, positioning the uploaded content at that PHP location. As the server processes the resultant file, the embedded PHP code is executed.
Wordfence’s advisory outlined a similar exploitation sequence, indicating that the attack begins with the assailant acquiring a valid nonce through Bricksforge’s bricksforge_regenerate_nonce AJAX endpoint.
Subsequently, the attacker uploads a specially crafted file and submits a form with the manipulated temporaryFileUploads parameter.
Attackers are currently targeting the plugin’s REST API submission endpoint,/wp-json/bricksforge/v1/form_submitalongside the WordPress AJAX endpoint associated with the bricksforge_form_submit action.
They have also attempted to circumvent extension filters by employing various methods, including using alternatives like .php5, .php7, and .phtml, tweaking the capitalization of file extensions, and encoding segments of the extension.
Should the exploitation succeed, attackers could commandeer the server to execute arbitrary PHP code.
The extent of access obtained may allow them to seize control of the website, deploy web shells, extract sensitive data, or sustain access even after the primary breach.
According to Patchstack, 63 unique source IP addresses have been monitored for this activity. Their telemetry has identified two significant clusters of requests: one cluster involved 44 IP addresses initiating 56 requests featuring identical payloads within a brief timeframe, while another cluster consisted of three IPs experimenting with 25 variations of PHP extensions and encodings against a single temporary file.
The observed patterns imply automated exploitation practices utilizing rotating proxies or distributed networks.
Nevertheless, Patchstack has noted that the documented activity does not provide conclusive evidence that all requests originated from a singular threat actor.
Patchstack highlighted six IP addresses responsible for approximately 46% of the documented requests:
177.75.57[.]2023.97.62[.]14684.247.60[.]12538.154.185[.]97150.109.16[.]166153.75.90[.]146
Website proprietors utilizing Bricksforge are highly advised to install the corrected version at their earliest opportunity.
They should also scrutinize requests to the form submission endpoints, particularly searching for repeated or anomalous submissions involvingtemporaryFileUploads and investigate the /wp-content/uploads/bricksforge/tmp/ directory for any unexpected PHP files.
The security advisory specifies version 3.1.8.10 as the patch for the affected release, while the most recent version noted within the advisory is 4.0.1.
Administrators are encouraged to secure the latest compatible patched version available from the plugin’s official source, rather than relying on an outdated fixed version.
Source link: Techlomedia.in.
