# Bricksforge WordPress plugin: unauthenticated file upload to RCE exploited in the wild (CVE-2026-85097) · pwn.watch

> CVE-2026-85097 (CVSS 10.0) in the Bricksforge plugin for the Bricks builder lets unauthenticated attackers run PHP on a WordPress site. Bricksforge checks an upload's MIME type but trusts the url field in temporaryFileUploads at form submission, so attackers fetch a nonce, upload a GIF/PHP polyglot and have it written to a .php path. Patchstack saw exploitation from Oct 7 from 63 IPs. Versions through 3.1.8.9 are affected; update to 3.1.8.10 or later.

Page: https://pwn.watch/i/bricksforge-wordpress-rce-cve-2026-85097 · generated 2026-10-24T08:44:16.553Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Bricksforge (WordPress plugin)
- Started: 2026-10-07
- CVEs: CVE-2026-85097
- Affected: Bricksforge <= 3.1.8.9
- Fixed in: 3.1.8.10 (current 4.0.x)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/bricksforge-wordpress-rce-cve-2026-85097/feed.xml
- JSON Feed: https://pwn.watch/i/bricksforge-wordpress-rce-cve-2026-85097/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/bricksforge-wordpress-rce-cve-2026-85097.json
- This file: https://pwn.watch/i/bricksforge-wordpress-rce-cve-2026-85097/llms.txt

## Updates (newest first)
- 2026-10-12: SecurityWeek reports in-the-wild exploitation; Bricksforge 3.1.8.10 and later fix it. (https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/)
- 2026-10-07: Patchstack records the first exploitation attempts against CVE-2026-85097. (https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/)

## Fix brief
# Security brief: Bricksforge WordPress plugin: unauthenticated file upload to RCE exploited in the wild (CVE-2026-85097)

Source: https://pwn.watch/i/bricksforge-wordpress-rce-cve-2026-85097 · status: live · severity: critical · updated Oct 24, 2026, 06:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
CVE-2026-85097 (CVSS 10.0) in the Bricksforge plugin for the Bricks builder lets unauthenticated attackers run PHP on a WordPress site. Bricksforge checks an upload's MIME type but trusts the url field in temporaryFileUploads at form submission, so attackers fetch a nonce, upload a GIF/PHP polyglot and have it written to a .php path. Patchstack saw exploitation from Oct 7 from 63 IPs. Versions through 3.1.8.9 are affected; update to 3.1.8.10 or later.

Severity detail: CVSS 10.0; unauthenticated RCE; exploited since 2026-10-07 (Patchstack)

- Product: Bricksforge (WordPress plugin)
- CVE / advisory ids: CVE-2026-85097

## Affected versions
- Bricksforge <= 3.1.8.9

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 3.1.8.10 (current 4.0.x)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Update Bricksforge to 3.1.8.10 or later (`wp plugin update bricksforge` if installed from a source WP-CLI can reach; it is a premium plugin). Then check access logs for POST /wp-json/bricksforge/v1/form_submit with temporaryFileUploads (image path, .php url) and admin-ajax.php?action=bricksforge_form_submit, and look in wp-content/uploads for unexpected .php files such as login_admin_*.php.

## Latest updates
- Oct 12, 2026: SecurityWeek reports in-the-wild exploitation; Bricksforge 3.1.8.10 and later fix it.
- Oct 7, 2026: Patchstack records the first exploitation attempts against CVE-2026-85097.

## Advisories
- [Bricksforge version changelog](https://bricksforge.io/version-changelog/) (Bricksforge)

## Write-ups & news
- [Bricksforge WordPress Plugin Vulnerability Exploited in the Wild](https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/)
- [Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE](https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html)
- [CVE-2026-85097: Bricksforge Flaw Exploited for Unauthenticated RCE](https://socradar.io/blog/bricksforge-cve-2026-85097-exploited-rce/)

---
Machine-readable: https://pwn.watch/i/bricksforge-wordpress-rce-cve-2026-85097.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.