Critical Vulnerability Targeted in Bricksforge Plugin
Cyber assailants are currently exploiting a severe security vulnerability in the Bricksforge WordPress plugin, which enables unauthorized PHP code execution without requiring user authentication.
This vulnerability, cataloged as CVE-2026-85097, is attributed a maximum Common Vulnerability Scoring System (CVSS) rating of 10.0 and has the potential to facilitate remote code execution on compromised sites.
Patchstack first detected instances of exploitation on October 7, 2026, at precisely 21:47:17 UTC.
The flaw impacts all Bricksforge versions up to and including 3.1.8.9, while version 3.1.8.10 has been designated as the remedied iteration.
Bricksforge enhances the capabilities of Bricks Builder by incorporating advanced forms, animations, dynamic data tools, and comprehensive site controls. Notably, the form upload mechanism stands at the epicenter of this security breach.
As outlined in Patchstack’s technical documentation, Bricksforge performs a MIME type verification during the initial file upload.
This verification aims to ascertain whether the submitted file constitutes an approved image format. However, subsequent form submissions are inadequately scrutinized, permitting the plugin to rely on visitor-provided file information without thorough checking of the URL field in temporaryFileUploads.
Exploiting this oversight, attackers can upload files masquerading as GIFs while containing embedded PHP code.
Initially, these images bypass the MIME type validation and reside in the temporary upload directory. A strategically crafted form submission later aligns the server path of the image with a destination URL that concludes with a PHP extension.
The Bricksforge plugin acquiesces to these requests and routes the file contents to the designated PHP location. When the file is subsequently accessed, the server executes the concealed code.
This breach enables perpetrators to deploy web shells, alter website content, extract confidential data, or maintain prolonged access.
Additionally, the attack leverages the publicly accessible bricksforge_regenerate_nonce AJAX action to acquire a valid request token.
Exploitation of WordPress Plugin Vulnerability
This incident is distinct from the previously identified remote code execution vulnerability associated with Bricks Builder.
It underscores the pervasive risks associated with file upload vulnerabilities in various WordPress plugins, illustrating how inadequate file management can transform an ostensibly benign upload function into a conduit for code execution.
Nearly all documentation of attempts captured was directed at /wp-json/bricksforge/v1/form_submit. A separate attempt targeted /wp-admin/admin-ajax.php utilizing the bricksforge_form_submit action.
Approximately 95% of the requests featured server paths that ended in .gif or .png formats, frequently coupled with PHP destination URLs.
Attackers experimented with file extensions such as .php5, .php8, and .phtml, employing mixed capitalization and encoded filenames.
Some attempts aimed to deposit login_admin_*.php files into conventional WordPress upload directories rather than confining them to the temporary directory.
Patchstack identified 63 distinct source IP addresses involved in these actions. One group consisted of 44 IPs executing 56 identical requests within mere seconds, while another group comprised three IPs experimenting with 25 variations in extension and encoding.
This pattern indicates automated operations utilizing distributed infrastructure, yet it does not provide definitive insight into the identity of a singular attacker.
Administrators are urged to upgrade any impacted installations to version 3.1.8.10 or later. The vendor’s changelog further documents a security enhancement for Pro Forms upload introduced in version 4.0.1, launched on October 8, and recommends updates even where active forms lack upload capabilities.
It is prudent to scrutinize logs for any suspicious temporary FileUpload submissions and to inspect /wp-content/uploads/bricksforge/tmp/ as well as other upload directories for unanticipated PHP files.
Additionally, reviewing requests related to newly established scripts and unauthorized alterations is essential.
Patchstack asserts that its RapidMitigate rule effectively obstructs exploitation attempts, providing interim protection in scenarios where immediate updates are unfeasible. Nevertheless, sites previously exposed should undergo rigorous compromise assessments.
Source link: Cybersecuritynews.com.
