# Active Exploitation of Bricksforge WordPress Plugin Unauthenticated File Upload / RCE (CVE-2026-85097, CVSS 9.8–10.0)

> CVE-2026-85097 in the Bricksforge WordPress plugin (<= 3.1.8.9) lets unauthenticated attackers upload GIF/PHP polyglot files and have them written to a .php path, resulting in remote code execution. Exploitation was first observed on 2026-10-07 at 21:47 UTC from 63 unique source IPs; fixed in 3.1.8.10 (and 4.0.1).

- **Published:** 2026-10-12T09:56:27Z
- **Last reviewed:** 2026-10-12T09:56:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3341
- **ID:** TL-2026-3341
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85097

## Description

The Bricksforge plugin's Pro Forms module validates MIME type correctly when a file is first uploaded to its temporary directory, but at form submission it trusts client-supplied metadata and does not validate the 'url' field inside the 'temporaryFileUploads' parameter. An unauthenticated attacker first obtains a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint, then uploads a GIF/PHP polyglot (a valid image carrying PHP code) to /wp-content/uploads/bricksforge/tmp/. The attacker then submits the form (POST /wp-json/bricksforge/v1/form_submit, or /wp-admin/admin-ajax.php with action=bricksforge_form_submit) with a 'temporaryFileUploads' entry whose server-side 'file' path points at the validated .gif while the attacker-controlled 'url' ends in .php. The plugin places the file contents at the .php location, and requesting that file executes the embedded PHP. Per the vendor changelog, all sites with Pro Forms active are affected, including those without any upload field.

Patchstack first observed exploitation on 2026-10-07 at 21:47:17 UTC, from 63 unique source IPs. Six IPs (a mix of ISP, datacenter and cloud-provider address space) produced about 46% of requests, consistent with automated exploitation over rotating proxies. Two clusters were described: 44 IPs sending 56 requests with identical payloads within seconds, and 3 IPs cycling through 25 PHP extension and encoding variations (.php5, .php7, .php8, .phtml, .pht, .phtm, .phps, mixed case, and URL-encoded forms such as %2ephp, .%70hp, .%2570%2568%2570) against the same file, also altering the path, name, originalFilename and url metadata fields. About 95% of captured requests disguised the payload as GIF/PNG. Post-exploitation indicators reported by Patchstack include unexpected PHP files in the Bricksforge tmp directory or the uploads tree, files named login_admin_*.php under /wp-content/uploads/YYYY/MM/, and unauthorized administrator accounts. The sources name no threat actor and no malware family; no second-stage payload was documented for this vulnerability.

Scoring differs by source: Wordfence/OpenCVE record CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-434), while Patchstack and The Hacker News cite 10.0. The 9.8 vector is recorded here because it is the only published vector. Patchstack tracks roughly 6,000 active installations. Dr. Web (drweb.de) notes this is the third critical Bricksforge vulnerability in five weeks, following CVE-2026-84814 (CVSS 9.8, subscriber-to-administrator privilege escalation, disclosed Sept 2, fixed in 3.1.8.9) and CVE-2026-18030 (CVSS 8.1, unauthenticated password reset via Pro Forms, disclosed Sept 18, fixed in 3.1.8.8). Bricksforge versions up to and including 3.1.8.9 are vulnerable; 3.1.8.10 fixes it and 4.0.1 (released 2026-10-08) is the recommended release. Patchstack offers a RapidMitigate virtual patch as interim protection. Defenders should treat any site that ran a vulnerable version since 2026-10-07 as potentially compromised.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1036.008 Masquerading: Masquerade File Type
- T1027 Obfuscated Files or Information

## Sources

- [Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE](https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html)
- [Patchstack: Critical unauthenticated arbitrary file upload vulnerability exploited in Bricksforge plugin](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)
- [OpenCVE: CVE-2026-85097](https://app.opencve.io/cve/CVE-2026-85097)
- [Wordfence Threat Intel: Bricksforge vulnerability e993c929-f175-43a7-92e6-9d3b089b8dde](https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde)
- [Dr. Web: Bricksforge Sicherheitslücke Upload aktiv ausgenutzt](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)
- [INCIBE-CERT: CVE-2026-85097](https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-85097)
- [TheHackerWire: CVE-2026-85097](https://www.thehackerwire.com/vulnerability/CVE-2026-85097/)
- [Bricksforge version changelog](https://bricksforge.io/version-changelog/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3341