+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHosting

CVE-2026-85097: Bricksforge ≤3.1.8.9 Unauth PHP Upload, Hit in the Wild Oct 7 - Floor 3.1.8.10 / 4.0.1

By ServerGurus Team13 October 20266 min read
CVE-2026-85097: Bricksforge ≤3.1.8.9 Unauth PHP Upload, Hit in the Wild Oct 7 - Floor 3.1.8.10 / 4.0.1

The Situation

NVD published CVE-2026-85097 at 2026-10-08T07:16:31.710 (last modified 2026-10-08T17:24:11.230, status Deferred). CNA is Wordfence (security@wordfence.com). Product: WordPress plugin Bricksforge, slug bricksforge. Affected: 0 through 3.1.8.9. Wordfence patched version: 3.1.8.10. Wordfence lists it publicly published 7 October 2026, last updated 8 October 2026. CVE AWG reserved 2026-09-03T01:41:17.605Z, published 2026-10-08T06:42:09.676Z. Researcher credit: d.v4n_s3c.[2][6][9]

Wordfence / CNA CVSS v3.1 is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Privileges required: none. User interaction: none. CWE-434 (unrestricted upload of a dangerous type). Patchstack scores the same bug 10.0; The Hacker News repeats 10.0. We treat 9.8 as the CNA number and note the 10.0 as Patchstack's, not a second CVE.[1][4][7]

This is not WordPress core and not Bricks Builder core. Bricksforge is a commercial add-on that extends Bricks (Pro Forms, animations, etc.). The WordPress.org plugin API for slug bricksforge 404s - you will not wp plugin search it. Hunt the directory on disk.[12]

CISA KEV catalog version 2026.10.08 (1,739 entries; newest dateAdded still 2026-10-08) does not list this CVE. CISA ADP SSVC on 2026-10-08T14:24:30.449178Z is Exploitation: none, Automatable: yes, Technical Impact: total. That SSVC stamp is hours after Patchstack's first observed attempt and still says none. Treat Patchstack telemetry as the exploitation evidence; do not wait for a KEV due date.[1][3][4]

What the bug actually is

Wordfence / NVD, verbatim: insufficient validation of the attacker-controlled URL field in the temporaryFileUploads parameter during form submission. An unauthenticated attacker can obtain a nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot that passes MIME checks into the temporary upload directory, then submit a form whose server-side file path points at that GIF while the url field ends in .php. Result they state: unauthenticated upload and execute of arbitrary PHP.[1][2]

Patchstack locates the metadata trust in Pro Forms (includes/elements/pro-forms/actions/init.php and .../base.php). We did not open those files. Vendor changelog for 4.0.1 (8 October 2026) says a Pro Forms file-upload security issue "affects every site with Pro Forms active, including sites whose forms use no upload fields," and names CVE-2026-85097 as an arbitrary file upload in the same area already fixed in 3.1.8.10 and 4.0.0. Floor we are telling operators: 3.1.8.10 on the 3.x line, 4.0.1 if you are on 4.x - do not sit on 4.0.0 because the vendor shipped another upload fix on 8 Oct.[4][5]

We are not publishing a form-submit body. Do not treat this paragraph as a lab result from us.

Exploitation - Patchstack, not us

Patchstack: first observed attempt 7 October 2026, 21:47:17 UTC. Almost all hits were POST /wp-json/bricksforge/v1/form_submit; one remainder was admin-ajax.php with action bricksforge_form_submit. Every request carried a crafted temporaryFileUploads. Signature they published: image path (.gif / .png in ~95% of captures) paired with a PHP-related destination URL. Most aimed at /wp-content/uploads/bricksforge/tmp/; some used destination names matching login_admin_*.php under /wp-content/uploads/2026/10/. Extension probing they list: .php5 .php7 .php8 .phtml .pht .phtm .phps, mixed case, URL-encoded / double-encoded forms. Two clusters: 44 IPs / 56 identical payloads within seconds; 3 IPs cycling 25 extension/encoding variants against the same temp file. 63 unique source IPs; six addresses ~46% of volume. They call it automated / rotating infrastructure and do not attribute an actor. SecurityWeek (12 Oct) and The Hacker News (12 Oct 15:16 GMT) are secondary writeups of that telemetry.[4][7][8]

CISA has not moved SSVC off none as of the 8 Oct ADP object we pulled this morning. Absence from KEV is not absence of scanners.[1][3]

Hunt the fleet - prove absence, then hunt disks

Do not grep for "Bricks" the theme/builder and call it done. The CNA product is slug bricksforge.

# locate the slug (cPanel/CloudLinux homes, Plesk vhosts, generic)
find /home /var/www /srv -path '*/wp-content/plugins/bricksforge' -type d 2>/dev/null

# version from headers, no PHP bootstrap required
grep -hE '^[[:space:]]*\*?[[:space:]]*Version:' \
  /home/*/public_html/wp-content/plugins/bricksforge/bricksforge.php \
  2>/dev/null

# per-site, when wp-cli is on the account
wp plugin get bricksforge --field=version --skip-plugins --skip-themes

Anything bricksforge ≤ 3.1.8.9 is in range. Wordfence's patched version is 3.1.8.10. If the site is already on 4.x, vendor current on the changelog we fetched is 4.0.1 (8 Oct 2026). Because this plugin is premium, wp plugin update bricksforge from wordpress.org will fail - update from Bricksforge's own channel.[2][5][12]

If you cannot patch today: deactivate bricksforge, or WAF the two form endpoints Patchstack named. Compensating control that breaks this class of upload bug on every WordPress vhost, not just this plugin:

# nginx - deny PHP execution under uploads
location ~* /wp-content/uploads/.*\.(php|phtml|php5|php7|php8)$ { deny all; }

That is not a substitute for 3.1.8.10 / 4.0.1.[4][2]

After patch, if the site ran a vulnerable build on or after 7 Oct 2026 without a virtual patch, treat it as possibly compromised until you have looked:

find /home /var/www /srv -path '*/wp-content/uploads/bricksforge/tmp/*' \
  \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.php?' \) 2>/dev/null
find /home /var/www /srv -path '*/wp-content/uploads/*' -iname 'login_admin_*.php' 2>/dev/null

Hunt logs for unauthenticated POSTs to /wp-json/bricksforge/v1/form_submit and admin-ajax.php with bricksforge_form_submit / bricksforge_regenerate_nonce. Patchstack published six noisy source IPs; they also said 63 IPs and rotation - do not close the ticket on an IP block.[4]

Honesty / What We Could Not Verify

  • We did not exploit this. No PoC was run against a lab or a customer vhost. No plugin zip was unpacked.
  • Not on CISA KEV as of catalog version 2026.10.08 (count 1739, last dateAdded 2026-10-08). We re-read that JSON this morning. CISA ADP SSVC same CVE: Exploitation none as of 2026-10-08T14:24:30.449178Z. Patchstack's first-seen timestamp is 7 Oct 21:47:17 UTC. Those two statements both stand; we are not collapsing them.[1][3][4]
  • CVSS 9.8 vs 10.0. CNA/Wordfence/NVD vector is 9.8. Patchstack and THN say 10.0. No CVSS v4 object on the NVD record we pulled.[1][4][7]
  • 3.1.8.10 heading missing from our changelog scrape. The jina extract of bricksforge.io/version-changelog ended at 3.1.8.9 (28 Aug 2026) after 4.0.1 / 4.0.0. Wordfence names patched 3.1.8.10. Vendor 4.0.1 text names 3.1.8.10 and 4.0.0 as the CVE fix. We did not download those packages to diff temporaryFileUploads handling.[2][5]
  • 4.0.0 vs 4.0.1. Vendor says 85097 was fixed in 3.1.8.10 and 4.0.0, then shipped another Pro Forms upload security fix in 4.0.1 on 8 Oct. Operators on 4.0.0 should still take 4.0.1. We did not prove 4.0.0 is or is not exploitable for 85097 beyond that sentence.[5]
  • Install count. Patchstack's article card shows 6K. That is Patchstack's figure, not wordpress.org active_installs (slug 404). Marketing "millions of sites" language on aggregator pages is not used here.[4][12]
  • Pro Forms with no upload field. That "including sites whose forms use no upload fields" sentence is the 4.0.1 changelog, which the vendor ties to the same area as 85097. We are not asserting Wordfence reproduced a no-upload-field exploit; patch anyway.[5]
  • This lab did not install Bricks or Bricksforge.

What this is not

  • Not CVE-2026-97670 (Avada Fusion Builder ≤ 7.16.1 unauth action-hook dispatch, Wordfence 9.1, patched 7.16.2). Different slug (fusion-builder). Yesterday's queue item; still patch Avada separately.
  • Not CVE-2026-87902 (WordPress core page-template LFI / conditional RCE, KEV 25 Sep 2026). Core, not this plugin.
  • Not Bricks Builder core. Do not bump Bricks and skip bricksforge.
  • Not the THN-adjacent XSS campaign in WPC Product Bundles (CVE-2026-93836) / Ninja Forms (CVE-2026-94504). Same THN article, different plugins, not unauth file upload.[7]
  • Not a cPanel / Plesk / LiteSpeed / Proxmox KEV. No new named-stack KEV since catalog 2026.10.08.[3]

Sources

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-85097 - NVD CVE-2026-85097 [2] https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde?source=cve - Wordfence CVE-2026-85097 [3] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON [4] https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/ - Patchstack Bricksforge ITW [5] https://bricksforge.io/version-changelog/ - Bricksforge changelog [6] https://www.cve.org/CVERecord?id=CVE-2026-85097 - CVE.org CVE-2026-85097 [7] https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html - The Hacker News [8] https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/ - SecurityWeek [9] https://cveawg.mitre.org/api/cve/CVE-2026-85097 - CVE AWG JSON [12] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=bricksforge - WordPress.org plugin API bricksforge 404

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales