Attackers Exploit Critical Bricksforge WordPress Flaw for Unauthenticated Remote Code Execution
Summary
Attackers are exploiting CVE-2026-85097 in Bricksforge for unauthenticated PHP code execution on WordPress sites. Versions through 3.1.8.9 are affected; site owners should update and check for signs of compromise.
Key points
- CVE-2026-85097 has a CVSS score of 10.0 and allows unauthenticated remote code execution through arbitrary PHP file uploads.
- Bricksforge versions up to and including 3.1.8.9 are affected; version 3.1.8.10 contains a fix, and the article advises updating to the latest version, 4.0.1.
- The flaw stems from insufficient validation of the client-supplied URL in the temporaryFileUploads parameter during form submission.
- Attackers have targeted the Bricksforge form submission REST API and the WordPress admin-ajax.php endpoint, using alternate or encoded PHP extensions.
- Successful exploitation can enable attackers to take control of a site, deploy web shells, access sensitive data, or maintain persistent access.
- Patchstack observed activity from 63 source IPs; the reported clusters suggest automated exploitation but do not identify a specific threat actor.
- Site owners should review relevant form submissions and temporary upload directories, and check for signs of compromise.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Insufficient validation of a client-supplied file URL
- Severity
- Critical (CVSS 10.0)
- Affected Versions
- Bricksforge versions up to and including 3.1.8.9
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-85097The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote codeCVE-2026-93836(XSS) vulnerabilities in two unrelated WordPress plugins, WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS score: 7.1) and Ninja Forms (CVE-2026-94504, CVSS score: 7.1), to deliver a JavaScript payloadCVE-2026-94504plugins, WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS score: 7.1) and Ninja Forms (CVE-2026-94504, CVSS score: 7.1), to deliver a JavaScript payload ("x.js") capable of deploying a backdoor plugin
Products
BricksBricksforge is a WordPress plugin that's advertised as a "Swiss Army knife" for Bricks, a visual website-building tool for WordPress, with support for animations, advanced forms, and scrolling video sequences.BricksforgeA maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.Ninja Formsunrelated WordPress plugins, WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS score: 7.1) and Ninja Forms (CVE-2026-94504, CVSS score: 7.1), to deliver a JavaScript payload ("x.js") capable of deploying aWordPressA maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.WPC Product Bundles for WooCommerceabusing cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS score: 7.1) and Ninja Forms (CVE-2026-94504, CVSS score: 7.1), to
Countries
AustraliaThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.BrazilThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.CzechiaThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.FranceThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.GermanyThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.NetherlandsThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.NorwayThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.SwitzerlandThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.UkraineThe vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.United States