Bricksforge: Critical File Upload Flaw Is Already Being Exploited (CVE-2026-85097)

On October 8, 2026, Patchstack published a critical vulnerability in the Bricksforge plugin for WordPress, tracked as CVE-2026-85097. The attacker does not need to log in. They upload a file containing PHP code and the server runs it. From there they can deploy web shells (scripts for controlling the server remotely), change site content, read data, and set up a way back in. The CVSS score is 10.0, the maximum. Attacks are already happening: Patchstack first saw an attempt on October 7, 2026 at 21:47 UTC.

Who is affected

Every Bricksforge version up to and including 3.1.8.9 is vulnerable. The fix is in version 3.1.8.10. Bricksforge is an add-on for the Bricks Builder visual site builder. If it is not installed on your site, this flaw does not affect you. If it is, follow the steps below.

How the attack works

In short: the plugin checks that an uploaded file is an image, but later trusts the form about where to save it. The attacker supplies an image that is also PHP code and has it saved as a PHP file. Technically, the plugin validates the MIME type when a file is first uploaded, but when a form is submitted it trusts the metadata the client sends. It does not validate the url field inside the temporaryFileUploads parameter. The attack takes four steps:

1. The attacker requests a valid nonce (a one-time security token) from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint.
2. They upload a file that is both a valid GIF image and contains PHP code. It passes the type check and lands in the temporary upload folder.
3. They submit a form where the file path points to that image, but the url ends in a PHP extension.
4. The plugin trusts the submitted metadata and writes the file's contents to the PHP location. When that file is requested, the server executes the code.

What Patchstack sees in the wild

The attacks are automated and come from many IP addresses (Patchstack counted 63). The attackers also try many variations of the file extension to get around filtering.

What to do today

1. Check the version. In the WordPress admin, open Plugins → Installed Plugins. If Bricksforge is there in version 3.1.8.9 or lower, you are vulnerable.
2. Update. To 3.1.8.10 or later, immediately, or ask whoever maintains your site to do it today. Our advice: have a fresh backup first, but don't delay the update for it.
3. Look for traces. This applies to sites that ran a version up to 3.1.8.9 without protection, especially since October 7. For those, Patchstack advises reviewing historical logs and the server itself. In our view, patching the plugin does not remove files that were uploaded earlier.
   • Files: in /wp-content/uploads/, including the bricksforge/tmp/ subfolder, look for files ending in .php. Names like login_admin_*.php are the red flag.
   • Logs: look for requests to /wp-json/bricksforge/v1/form_submit that include a temporaryFileUploads parameter, and for requests to newly created PHP files in the uploads folders.
   • If you find something (our recommendation, not Patchstack's): don't delete it blindly. Call your developer or host, and plan on restoring from a clean backup and changing passwords.

If you already use Patchstack, it has a RapidMitigate rule for this flaw that blocks attacks at the traffic layer without touching plugin code. Patchstack says the rule was live before the first attack arrived. Without Patchstack, updating is the only fix. And updating to 3.1.8.10 or later is still required either way.

If you are not sure what to look for in the files and logs, we can go through the site as part of a security audit.