Critical Security Flaw Detected in Bricksforge Plugin for WordPress
A high-severity security vulnerability affecting the Bricksforge plugin for WordPress has been identified and is currently being exploited in real time, as reported by Patchstack.
This significant vulnerability, cataloged as CVE-2026-85097 (CVSS score: 10.0), permits unauthenticated assailants to upload and execute arbitrary PHP scripts on susceptible WordPress installations, which can culminate in remote code execution (RCE).
The flaw is prevalent in Bricksforge versions up to and including 3.1.8.9. A remediation patch has been made available in version 3.1.8.10.
Bricksforge is heralded as a versatile tool within the WordPress ecosystem, likened to a “Swiss Army knife” for Bricks, which is a visual website-building mechanism offering an array of functionalities such as animations and advanced form capabilities.
On October 7, 2026, at 9:47 p.m. UTC, Patchstack observed attempts to exploit the vulnerability. According to their findings, “Bricksforge performs MIME type validation on file uploads initially.
However, it subsequently relies on metadata transmitted by the client during form submissions,” they elucidated. “Notably, it fails to validate the ‘url’ field within the ‘temporaryFileUploads’ parameter.”
In essence, the vulnerability arises from inadequate validation of the URL field during form submission, a flaw that an attacker can exploit through a series of deliberate actions:
- Obtain a valid nonce via the unauthenticated ‘bricksforge_regenerate_nonce’ AJAX endpoint.
- Upload a GIF/PHP hybrid — a file that masquerades as a valid image while harboring PHP code, which successfully passes the MIME validation and is placed into the temporary upload directory.
- Submit a form where the ‘file’ path points to the validated image, yet the ‘url’ points to a PHP extension.
- Bricksforge naively trusts the submitted metadata, thereby allowing the file’s contents to be executed when the file is requested at the PHP location.
Wordfence noted, “An unauthenticated attacker can initially secure a valid nonce through the bricksforge_regenerate_nonce AJAX endpoint, followed by uploading a GIF/PHP hybrid file to the appropriately validated temporary upload directory.”
Subsequent actions involve submitting a form where the crafted ‘temporaryFileUploads’ parameter misleadingly links to the validated GIF, with the ‘url’ ending in a .php extension.
The successful exploitation of this vulnerability can lead to arbitrary PHP execution on the server, enabling an attacker to commandeer the WordPress site, deploy web shells, access sensitive information, and enact persistent control.
Patchstack has elucidated that attacks have been primarily directed at the Bricksforge REST API form submission endpoint (“/wp-json/bricksforge/v1/form_submit”) or the “/wp-admin/admin-ajax.php” endpoint, specifically with the “bricksforge_form_submit” action, along with a manipulated “temporaryFileUploads” parameter.
Illustratively, a request might resemble the following:
{
"temporaryFileUploads": [
{
"field": "form-field-file",
"file": {
"file": "/var/www/example.com/wp-content/uploads/bricksforge/tmp/img_example.gif",
"url": "https://example.com/wp-content/uploads/bricksforge/tmp/img_example.php",
"type": "image/gif"
}
}
]
}Wordfence underscores the discrepancy exploited by attackers, wherein the specified “file” argument is a GIF or PNG file, while the URL correspondingly directs to a PHP payload.
To bypass file extension restrictions, attackers have employed various tactics, including alternate PHP file extensions (e.g., .php5, .php7, or .phtml), case variations (e.g., .PHP, .Php, or .pHp), and encoded extensions (e.g., .%70hp, %2ephp, or .%2570%2568%2570).
Patchstack elaborates on the scope of these threats, referencing two noteworthy clusters in their telemetry.
The first cluster involved 44 IPs producing 56 requests with identical payloads within mere seconds, while the second cluster recorded three IPs experimenting with 25 variations of PHP extensions and encodings against the same temporary file.
The activity has originated from 63 distinct IP addresses, with six accounting for approximately 46% of all requests:
- 177.75.57[.]20
- 23.97.62[.]146
- 84.247.60[.]125
- 38.154.185[.]97
- 150.109.16[.]166
- 153.75.90[.]146
In light of these developments, users are strongly urged to update their plugins to the latest version (4.0.1) in order to safeguard against the threat.
Additionally, site owners should conduct audits of incoming requests to the “/wp-json/bricksforge/v1/form_submit” endpoint containing a “temporaryFileUploads” parameter, as well as scrutinize for any unusual form submissions and unexpected PHP files in the “/wp-content/uploads/bricksforge/tmp/” directory.
Exploitation of Vulnerabilities in Other WordPress Plugins
This alarming revelation coincides with ongoing abuse of cross-site scripting (XSS) vulnerabilities found in two unrelated WordPress plugins: WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS score: 7.1) and Ninja Forms (CVE-2026-94504, CVSS score: 7.1).
These vulnerabilities are being exploited to deliver a JavaScript payload (“x.js”) capable of installing backdoor plugins and creating unauthorized admin accounts.
These plugins feature an unauthenticated file manager that can be accessed directly through requests to the plugin’s main PHP file.
Consequently, they can create a WordPress administrator that is concealed from the Users screen and establish a login URL that grants access as the primary administrator of the site.
Patchstack commented, This constitutes a post-exploitation and persistence implant within WordPress, designed to operate seamlessly within the browser of an authenticated admin.
Upon execution, it exploits the logged-in administrator’s session to install a malicious WordPress plugin, forge a new administrator account, implement further persistence measures, and send telemetry back to the attacker’s infrastructure.
It is crucial to note that while updating vulnerable plugins (version 8.6.7 for WPC Product Bundles and version 3.15.4 for Ninja Forms) can avert further exploitation, it does not eradicate pre-existing infections.
Site owners must interrogate their databases to eliminate hidden administrators, investigate must-use plugin directories, and scrutinize web server logs for suspicious activities.
Trends in WordPress Exploitation During Q2 2026
Data revealing vulnerabilities from Wordfence indicates that a total of 2,073 WordPress-related vulnerabilities were disclosed in the second quarter of 2026, with a noticeable 15.2% increase in high-threat flaws, totaling 182. During this timeframe, approximately 573,000 WordPress sites fell victim to compromises.
Among the most targeted vulnerabilities are the following:
- CVE-2024-28000 (CVSS score: 9.8) – LiteSpeed Cache <= 6.3.0.1 – Unauthenticated Privilege Escalation.
- CVE-2019-9879 (CVSS score: 9.8) – WPGraphQL <= 0.2.3 – Administrative User Creation.
- CVE-2016-15042 (CVSS score: 9.8) – Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 – Arbitrary File Upload.
- CVE-2023-28121 (CVSS score: 9.8) – WooCommerce Payments 4.8.0 – 5.6.1 Authentication Bypass and Privilege Escalation.
- CVE-2025-3102 (CVSS score: 8.1) – SureTriggers <= 1.0.78 – Unauthenticated Administrative User Creation
The overwhelming majority of attacking IP addresses originated within the United States, followed closely by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.
As emphasized by Wordfence, “A robust firewall, timely application of vulnerability patches, and fortified configurations are essential in preventing malicious traffic from reaching your site.”
They advise that comprehensive scanning is vital to detect vulnerabilities, malware, or suspicious changes that may signify an attempted breach, while real-time alerts about critical events, login attempts, and file alterations are pivotal in preemptively addressing threats.
Source link: Thehackernews.com.
