Attackers exploit max-severity Bricksforge flaw to run code on WordPress sites

Attackers are actively exploiting a maximum-severity vulnerability in Bricksforge, a popular add-on plugin for the Bricks visual builder on WordPress, to upload and execute arbitrary PHP code without authentication. According to WordPress security firm Patchstack, which rates the flaw tracked as CVE-2026-85097 at CVSS 10.0, the first exploitation attempts were recorded on October 7, 2026, at 21:47 UTC. Because successful attacks lead to remote code execution, site owners running affected versions face a risk of full site takeover.

What happened

Patchstack said in an October 8 advisory that the vulnerability affects Bricksforge 3.1.8.9 and earlier and is fixed in version 3.1.8.10. The Hacker News, which reported on the exploitation on October 12, said it observed both 3.1.8.10 and a later 4.0.1 release referenced as fixed versions and advised users to move to the latest release.

Patchstack recorded exploitation traffic from 63 unique source IP addresses, with the six most active addresses accounting for about 46% of requests. In one cluster, 44 IPs sent 56 requests with identical payloads within seconds of one another, while three IPs tested 25 variations of PHP file extensions and encodings against the same temporary file. Patchstack assessed the activity as automated, likely relying on rotating proxies or distributed infrastructure, and said the data alone does not attribute it to a single threat actor.

Technical details

According to Patchstack, Bricksforge validates a file's MIME type when it is first uploaded but later trusts client-supplied metadata when a form is submitted, in particular the url field inside the temporaryFileUploads parameter. The Hacker News, citing a Wordfence advisory, said attackers can obtain a valid nonce from an unauthenticated AJAX action, upload a file that is both a valid image and contains PHP code, and then cause the plugin to write that content to a location with a PHP extension, where it runs when requested.

Patchstack said most attempts targeted the /wp-json/bricksforge/v1/form_submit REST endpoint, with others sent to admin-ajax.php using the bricksforge_form_submit action. Attackers tried alternate extensions such as .phtml and .php7, mixed capitalization and URL-encoded forms to evade filters.

Who is affected

Any WordPress site running Bricksforge 3.1.8.9 or earlier is exposed, since the attack requires no login. Successful exploitation can be used to deploy web shells, read sensitive data and maintain persistent access, The Hacker News reported.

What to do

• Update Bricksforge to 3.1.8.10 or later immediately; The Hacker News recommends the latest 4.0.1 release.
• Review web server logs for requests to the form submit endpoint that contain a temporaryFileUploads parameter, and for calls to bricksforge_regenerate_nonce followed by uploads.
• Check /wp-content/uploads/bricksforge/tmp/ and other upload directories for unexpected PHP files; Patchstack specifically flagged files named login_admin_*.php.
• Patchstack noted that updating does not undo a compromise that already occurred, so sites that ran a vulnerable version unprotected should be inspected for unauthorized changes and unknown administrator accounts.