CVE-2026-85097

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10

Description The Bricksforge plugin for WordPress contains a flaw allowing unauthenticated attackers to upload and execute arbitrary PHP code on the server. The issue stems from insufficient validation of the attacker-controlled URL field within the temporaryFileUploads parameter during form submission. An attacker can obtain a valid nonce via the bricksforge regenerate nonce AJAX endpoint and upload a GIF/PHP polyglot file (a file that is valid as both a GIF image and a PHP script) to the temporary upload directory. By submitting a form where the server-side path points to this validated GIF but the URL field ends with a .php extension, the attacker can force the server to save the file as a PHP script.

Active exploitation has been observed, with reports of attack attempts from 63 unique IP addresses starting October 7, 2026. The vulnerability affects the Pro Forms functionality. Technical indicators include suspicious POST requests to the /wp-json/bricksforge/v1/form submit endpoint and the presence of unexpected PHP files in the /wp-content/uploads/bricksforge/tmp/ directory.

Recommendations Update Bricksforge to version 3.1.8.10 or later. As a temporary mitigation, block the /wp-json/bricksforge/v1/form submit endpoint at the Web Application Firewall (WAF). As a temporary mitigation, deactivate and remove the plugin. Restrict PHP execution in intended upload storage directories as a defense-in-depth measure.