Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Bricksforge WordPress plugin: unauthenticated file upload to RCE exploited in the wild (CVE-2026-85097)

Bricksforge (WordPress plugin)

CVE-2026-85097 (CVSS 10.0) in the Bricksforge plugin for the Bricks builder lets unauthenticated attackers run PHP on a WordPress site. Bricksforge checks an upload's MIME type but trusts the url field in temporaryFileUploads at form submission, so attackers fetch a nonce, upload a GIF/PHP polyglot and have it written to a .php path. Patchstack saw exploitation from Oct 7 from 63 IPs. Versions through 3.1.8.9 are affected; update to 3.1.8.10 or later.

Why this severity: CVSS 10.0; unauthenticated RCE; exploited since 2026-10-07 (Patchstack)

Started
Oct 7, 2026
CVE
CVE-2026-85097

Follow this incident

Affected

  • Bricksforge <= 3.1.8.9

Fixed in

  • 3.1.8.10 (current 4.0.x)

Timeline2

  1. SecurityWeek reports in-the-wild exploitation; Bricksforge 3.1.8.10 and later fix it.

  2. Patchstack records the first exploitation attempts against CVE-2026-85097.

Advisories1

News & write-ups3

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo