Critical Security Vulnerability in Bricksforge Plugin Exploited
A severe security vulnerability affecting the Bricksforge plugin for WordPress has been actively exploited, as reported by Patchstack.
The vulnerability, designated as CVE-2026-85097, boasts a maximum CVSS score of 10.0 and permits unauthenticated adversaries to upload and execute arbitrary PHP code on susceptible WordPress sites, culminating in remote code execution (RCE).
This security issue affects all versions of Bricksforge up to and including 3.1.8.9. A remedial patch has been made available in version 3.1.8.10.
Bricksforge is lauded as a multifaceted WordPress plugin, functioning as a “Swiss Army knife” for the Bricks visual website-building tool, with capabilities including animations, advanced forms, and dynamic video sequences.
According to Patchstack, exploitation attempts were first identified on October 7, 2026, at 9:47 PM UTC.
“Bricksforge performs initial MIME type validation upon file upload. However, during subsequent form submissions, it relies on the client-supplied file metadata,” Patchstack elaborated.
“Notably, it fails to validate the ‘url’ field contained within the ‘temporaryFileUploads’ parameter.”
In summary, the vulnerability arises from inadequate validation of the URL field in the ‘temporaryFileUploads’ parameter when a form is submitted. An assailant could exploit this security breach through a sequence of four steps:
- Fetch a valid nonce from the unauthenticated ‘bricksforge_regenerate_nonce’ AJAX endpoint.
- Upload a GIF/PHP polyglot: an image file that also embeds PHP code, thereby passing MIME validation and landing in the temporary upload directory.
- Submit a form where the ‘file’ path refers to the validated image, with the ‘url’ field terminating in a PHP extension.
- Bricksforge’s implicit trust in the submitted metadata positions the file’s contents at the PHP location, enabling the execution of the embedded code upon file request.
“An unauthenticated attacker can first obtain a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint, subsequently uploading a GIF/PHP polyglot file to the temporary upload directory, where MIME validation is correctly enforced,” stated Wordfence in its advisory regarding the flaw.
“Thereafter, the attacker can submit a form using a manipulative ‘temporaryFileUploads’ parameter, where the server-side file path points to the validated GIF file, while the attacker-controlled URL field concludes with a .php extension.”
Successful exploitation of this vulnerability carries the potential for arbitrary PHP execution on the server.
This capability allows an attacker to commandeer the WordPress site, deploy web shells, access sensitive information, and ensure persistent control.
In the exploitation attempts identified by Patchstack, threat actors primarily targeted the Bricksforge REST API form submission endpoint (“/wp-json/bricksforge/v1/form_submit”) and the “/wp-admin/admin-ajax.php” endpoint with the “bricksforge_form_submit” action, accompanied by a manipulated “temporaryFileUploads” parameter.
An illustrative request appears as follows:
{
"temporaryFileUploads": [
{
"field": "form-field-file",
"file": {
"file": "/var/www/example.com/wp-content/uploads/bricksforge/tmp/img_example.gif",
"url": "https://example.com/wp-content/uploads/bricksforge/tmp/img_example.php",
"type": "image/gif"
}
}
]
}As noted by Wordfence, an inconsistency is being exploited wherein the “file” argument specifies a GIF (or PNG), while the actual URL points to a PHP payload.
To circumvent extension filtering, the exploitation tactics include the use of alternative PHP extensions (e.g., .php5, .php7, or .phtml), case variations (e.g., .PHP, .Php, or .pHp), and encoded extensions (e.g., .%70hp, %2ephp, or .%2570%2568%2570).
“Our telemetry indicates two distinct clusters. The first consisted of 44 IPs generating 56 requests with identical payloads over a brief interval,” Patchstack stated.
“The second cluster comprised three IPs testing 25 variations of PHP extensions and encoding against the same temporary file.”
“Both patterns suggest automated exploitation through rotating proxies or distributed networks, yet do not definitively attribute the activity to a singular threat actor.”
This activity has been traced back to 63 distinct source IPs, with six of these accounting for approximately 46% of all requests:
- 177.75.57[.]20
- 23.97.62[.]146
- 84.247.60[.]125
- 38.154.185[.]97
- 150.109.16[.]166
- 153.75.90[.]146
Users are urged to upgrade to the latest version of the plugin (4.0.1) as a precaution. Site proprietors are also advised to scrutinize incoming requests to the “/wp-json/bricksforge/v1/form_submit” endpoint containing a “temporaryFileUploads” parameter, as well as to monitor for repeated form submissions and unexpected PHP files in the “/wp-content/uploads/bricksforge/tmp/” directory.
Exploitation of WPC Product Bundles for WooCommerce and Ninja Forms Vulnerabilities
The revelation coincides with ongoing misuse of cross-site scripting (XSS) vulnerabilities in two separate WordPress plugins, specifically WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS score: 7.1) and Ninja Forms (CVE-2026-94504, CVSS score: 7.1).
These flaws have been leveraged to deliver a JavaScript payload (“x.js”) that can install a backdoor plugin and create unauthorized admin accounts.
This plugin allows unauthenticated access via a direct request to its main PHP file, subsequently creating a hidden WordPress administrator account and deploying a “magic” login URL that grants the holder authentication as the site’s original administrator.
“This is a post-exploitation implant for WordPress, engineered to operate within the browser of a logged-in administrator,” stated Patchstack.
“Once activated, it exploits the authenticated wp-admin session to install a malicious WordPress plugin, establish a new administrator account, invoke an additional stealthy persistence mechanism, and relay results to attacker-controlled infrastructure.”
It is imperative to note that while updating the vulnerable plugins (version 8.6.7 for WPC Product Bundles for WooCommerce and version 3.15.4 for Ninja Forms) prevents further exploitation, it does not eradicate existing infections.
Site owners must conduct thorough audits for hidden administrators by querying the database directly, examining the must-use plugin directory, and analyzing web server logs.
WordPress Exploitation Trends in Q2 2026
Data from Wordfence reveals that in the second quarter of 2026, a total of 2,073 vulnerabilities related to WordPress were published, with high-threat flaws surging by 15.2% from the preceding quarter, reaching 182. During this period, approximately 573,000 WordPress sites were compromised.
The five most targeted vulnerabilities are as follows:
- CVE-2024-28000 (CVSS score: 9.8) – LiteSpeed Cache <= 6.3.0.1 – Unauthenticated Privilege Escalation.
- CVE-2019-9879 (CVSS score: 9.8) – WPGraphQL <= 0.2.3 – Administrative User Creation.
- CVE-2016-15042 (CVSS score: 9.8) – Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 – Arbitrary File Upload.
- CVE-2023-28121 (CVSS score: 9.8) – WooCommerce Payments 4.8.0 – 5.6.1 Authentication Bypass and Privilege Escalation.
- CVE-2025-3102 (CVSS score: 8.1) – SureTriggers <= 1.0.78 – Unauthenticated Administrative User Creation
A significant proportion of the attacking IP addresses originated from the United States, with additional sources including Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.
“A robust firewall, timely vulnerability fixes, and reinforced configurations can effectively obstruct malicious traffic before it reaches your site,” cautioned Wordfence.
Comprehensive scanning aids in identifying vulnerabilities, malware, or suspicious changes on your site that may indicate a compromise attempt.
Real-time alerts regarding critical events, login attempts, and file modifications assist in preemptively managing threats.
Source link: Thehackernews.com.
