cyber.hendryadrian.com
Vulnerability & Exploit · socradar.io

Attackers Exploit Critical Bricksforge WordPress Plugin Flaw for Unauthenticated RCE

· Original article ↗

Summary

Attackers are exploiting CVE-2026-85097, an unauthenticated RCE flaw in Bricksforge versions 3.1.8.9 and earlier. Update to 3.1.8.10 or later and check logs and upload directories for signs of compromise.

Key points

  • The CVSS 10.0 flaw enables unauthenticated PHP code execution through Bricksforge Pro Forms file uploads.
  • The exploit chains an unauthenticated nonce endpoint, a GIF/PHP polyglot upload, and a crafted form submission that redirects the file to a PHP destination.
  • Patchstack observed exploitation beginning October 7, 2026, and recorded activity from 63 unique source IPs; it did not attribute the activity to a specific actor.
  • Bricksforge versions 3.1.8.9 and earlier are affected; version 3.1.8.10 fixes the issue, and the article identifies 4.0.1 as the current release.
  • Update affected sites, then review logs and upload directories for suspicious requests and unexpected PHP files; a WAF rule can help when immediate patching is not possible.

Article Details

Vulnerability Types
  • Unauthenticated arbitrary file upload leading to remote code execution
Severity
CVSS 10.0 (Critical)
Affected Versions
  • Bricksforge 3.1.8.9 and earlier
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Where an immediate update is not possible, apply a WAF or virtual patching rule that blocks form submissions pairing image paths with PHP destination URLs.

Indicators of compromise

TypeIndicatorContext
IPV4150[.]109[.]16[.]166Source IP recorded among addresses involved in exploitation attempts.
IPV4153[.]75[.]90[.]146Source IP recorded among addresses involved in exploitation attempts.
IPV4177[.]75[.]57[.]20Source IP recorded among addresses involved in exploitation attempts.
IPV423[.]97[.]62[.]146Source IP recorded among addresses involved in exploitation attempts.
IPV438[.]154[.]185[.]97Source IP recorded among addresses involved in exploitation attempts.
IPV484[.]247[.]60[.]125Source IP recorded among addresses involved in exploitation attempts.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article identifies exploitation of the public-facing Bricksforge form submission functionality.

CVE

CVE-2026-85097CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE

Products

Bricks BuilderBricksforge is a WordPress plugin that extends Bricks Builder, a visual website-building tool for WordPress.BricksforgeCVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCEWordPressCVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE

Related Articles