Threat reportVulnerabilityTL-2026-3341
Active Exploitation of Bricksforge WordPress Plugin Unauthenticated File Upload / RCE (CVE-2026-85097, CVSS 9.8–10.0)
Active Exploitation of Bricksforge WordPress Plugin (TL-2026-3341) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-12. It has no confirmed attribution, affects Bricksforge Bricksforge WordPress plugin (Pro Forms module), references 1 CVE (CVE-2026-85097), maps to 7 MITRE ATT&CK techniques (T1027, T1036.008, T1059), and is covered by 9 detection rules and 14 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3341
- Threat ID
- TL-2026-3341
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, retail, news - media, small-business
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Active Exploitation of Bricksforge WordPress Plugin
Malware and tooling: PHP
How Active Exploitation of Bricksforge WordPress Plugin works
CVE-2026-85097 in the Bricksforge WordPress plugin (<= 3.1.8.9) lets unauthenticated attackers upload GIF/PHP polyglot files and have them written to a .php path, resulting in remote code execution. Exploitation was first observed on 2026-10-07 at 21:47 UTC from 63 unique source IPs; fixed in 3.1.8.10 (and 4.0.1).
The Bricksforge plugin's Pro Forms module validates MIME type correctly when a file is first uploaded to its temporary directory, but at form submission it trusts client-supplied metadata and does not validate the 'url' field inside the 'temporaryFileUploads' parameter. An unauthenticated attacker first obtains a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint, then uploads a GIF/PHP polyglot (a valid image carrying PHP code) to /wp-content/uploads/bricksforge/tmp/. The attacker then submits the form (POST /wp-json/bricksforge/v1/form_submit, or /wp-admin/admin-ajax.php with action=bricksforge_form_submit) with a 'temporaryFileUploads' entry whose server-side 'file' path points at the validated .gif while the attacker-controlled 'url' ends in .php. The plugin places the file contents at the .php location, and requesting that file executes the embedded PHP. Per the vendor changelog, all sites with Pro Forms active are affected, including those without any upload field.
Patchstack first observed exploitation on 2026-10-07 at 21:47:17 UTC, from 63 unique source IPs. Six IPs (a mix of ISP, datacenter and cloud-provider address space) produced about 46% of requests, consistent with automated exploitation over rotating proxies. Two clusters were described: 44 IPs sending 56 requests with identical payloads within seconds, and 3 IPs cycling through 25 PHP extension and encoding variations (.php5, .php7, .php8, .phtml, .pht, .phtm, .phps, mixed case, and URL-encoded forms such as %2ephp, .%70hp, .%2570%2568%2570) against the same file, also altering the path, name, originalFilename and url metadata fields. About 95% of captured requests disguised the payload as GIF/PNG. Post-exploitation indicators reported by Patchstack include unexpected PHP files in the Bricksforge tmp directory or the uploads tree, files named login_admin_*.php under /wp-content/uploads/YYYY/MM/, and unauthorized administrator accounts. The sources name no threat actor and no malware family; no second-stage payload was documented for this vulnerability.
Scoring differs by source: Wordfence/OpenCVE record CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-434), while Patchstack and The Hacker News cite 10.0. The 9.8 vector is recorded here because it is the only published vector. Patchstack tracks roughly 6,000 active installations. Dr. Web (drweb.de) notes this is the third critical Bricksforge vulnerability in five weeks, following CVE-2026-84814 (CVSS 9.8, subscriber-to-administrator privilege escalation, disclosed Sept 2, fixed in 3.1.8.9) and CVE-2026-18030 (CVSS 8.1, unauthenticated password reset via Pro Forms, disclosed Sept 18, fixed in 3.1.8.8). Bricksforge versions up to and including 3.1.8.9 are vulnerable; 3.1.8.10 fixes it and 4.0.1 (released 2026-10-08) is the recommended release. Patchstack offers a RapidMitigate virtual patch as interim protection. Defenders should treat any site that ran a vulnerable version since 2026-10-07 as potentially compromised.
MITRE ATT&CK techniques used in TL-2026-3341
Defense Evasion
T1027 Obfuscated Files or Information; T1036.008 Masquerading: Masquerade File Type
Execution
T1059 Command and Scripting Interpreter
Persistence
T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell
Initial Access
T1190 Exploit Public-Facing Application
Reconnaissance
Affected products and versions in Active Exploitation of Bricksforge WordPress Plugin
- Bricksforge — Bricksforge WordPress plugin (Pro Forms module)
Vulnerable versions: <= 3.1.8.9
Fixed in: 3.1.8.10; 4.0.1
Remediation for Active Exploitation of Bricksforge WordPress Plugin
Patches
- Bricksforge 3.1.8.10
- Bricksforge 4.0.1 (released 2026-10-08)
Immediate actions
- Update Bricksforge to 3.1.8.10 or later (4.0.1 recommended); if patching is not possible, deactivate and remove the plugin
- Search /wp-content/uploads/bricksforge/tmp/ and the wp-content/uploads/YYYY/MM/ tree for unexpected .php/.php5/.php7/.phtml/.pht/.phps files and login_admin_*.php files
- Audit WordPress administrator accounts for unauthorized users and rotate credentials and salts on any site where exploitation is suspected
- Review web access logs from 2026-10-07 onward for requests to /wp-json/bricksforge/v1/form_submit and admin-ajax.php?action=bricksforge_form_submit containing temporaryFileUploads
Workarounds
- Apply Patchstack RapidMitigate rule for traffic-layer blocking
- Block or restrict unauthenticated access to the bricksforge_regenerate_nonce and bricksforge_form_submit endpoints until patched
Longer-term hardening
- Block PHP execution in wp-content/uploads at the web server level
- Deploy a WAF or virtual patching that inspects temporaryFileUploads parameters for image-path/.php-URL mismatches
- Run file integrity monitoring on WordPress web roots and alert on new PHP files in upload directories
CVEs associated with Active Exploitation of Bricksforge WordPress Plugin
Weaknesses (CWE) in Active Exploitation of Bricksforge WordPress Plugin
Timeline of Active Exploitation of Bricksforge WordPress Plugin
- Bricksforge 3.1.8.9 is released with email-template security hardening; this is the last version vulnerable to CVE-2026-85097.
- CVE-2026-84814 (CVSS 9.8, subscriber-to-administrator privilege escalation) is disclosed in Bricksforge, the first of three critical flaws in five weeks.
- Bricksforge 4.0.0 is released as a major redesign of the plugin.
- CVE-2026-18030 (CVSS 8.1, unauthenticated password reset via Pro Forms) is disclosed in Bricksforge.
- Exploitation continues from 63 unique source IPs, including a cluster of 44 IPs sending identical payloads and 3 IPs testing 25 PHP extension/encoding variations.
- Patchstack first observes in-the-wild exploitation of the Bricksforge file upload flaw at 21:47:17 UTC.
- Bricksforge 4.0.1 is released with a Pro Forms file upload security fix; 3.1.8.10 also contains the fix.
- CVE-2026-85097 is published (CVSS 3.1 9.8, CWE-434) for Bricksforge versions through 3.1.8.9.
- The Hacker News publishes reporting on active exploitation of the Bricksforge flaw, citing Patchstack and Wordfence.
Sources cited for Active Exploitation of Bricksforge WordPress Plugin
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
- Patchstack: Critical unauthenticated arbitrary file upload vulnerability exploited in Bricksforge plugin
- OpenCVE: CVE-2026-85097
- Wordfence Threat Intel: Bricksforge vulnerability e993c929-f175-43a7-92e6-9d3b089b8dde
- Dr. Web: Bricksforge Sicherheitslücke Upload aktiv ausgenutzt
- INCIBE-CERT: CVE-2026-85097
- TheHackerWire: CVE-2026-85097
- Bricksforge version changelog
Detection coverage for TL-2026-3341
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3341 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.