Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Attackers are exploiting CVE-2026-85097 in the Bricksforge WordPress plugin. The flaw lets someone with no account upload a file and have the server run it as PHP. According to Patchstack, as reported by The Hacker News, it detected exploitation efforts on October 7, 2026, at 9:47 p.m. UTC. That is the time Patchstack saw the activity, not the date the bug was introduced or disclosed.

Every release up to and including 3.1.8.9 is vulnerable. Version 3.1.8.10 is the first fixed build, and the report advises moving to the current release, 4.0.1.

The severity score depends on the source. The Hacker News reports CVSS 10.0. The NVD data lists 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and classifies the weakness as CWE-434 (unrestricted upload of a file with a dangerous type).

Why a validated image ends up as a PHP file

Bricksforge is an add-on for the Bricks site builder that supplies animations, advanced forms and similar features. The bug is in its form handling. The plugin checks a file's MIME type correctly at upload time. When the form is submitted later, it accepts the file details sent by the browser at face value. Patchstack says it does not validate the url field inside the temporaryFileUploads parameter.

The NVD description and Wordfence's advisory lay out the sequence:

1. The attacker requests a valid nonce from the unauthenticated AJAX endpoint bricksforge_regenerate_nonce.
2. They upload a GIF/PHP polyglot, a genuine image that also carries PHP code. It passes the MIME check and lands in the temporary upload directory.
3. They submit a form whose file value points to that approved image, while the url value ends in a PHP extension.
4. Trusting the submitted metadata, the plugin writes the image's contents to the PHP-named location. The embedded code runs once that file is requested.

The Hacker News lists the consequences as arbitrary PHP execution, takeover of the site, web shell deployment, access to sensitive data and persistent access.

Patchstack observed requests aimed at /wp-json/bricksforge/v1/form_submit and at /wp-admin/admin-ajax.php with the action bricksforge_form_submit. The reported exploitation also tries to slip past extension filters. It uses alternate PHP suffixes (.php5, .php7, .phtml), mixed-case spellings (.PHP, .Php, .pHp) and encoded forms (.%70hp, %2ephp, .%2570%2568%2570).

What the traffic looks like

Patchstack's telemetry shows 63 distinct source IPs, with six of them responsible for roughly 46% of all requests. Two clusters stood out:

• Burst of identical requests: 44 IPs sent 56 requests with the same payload, all within seconds of each other.
• Extension probing: three IPs tried 25 variations of PHP extensions and encodings against a single temporary file.

Patchstack reads both patterns as automated exploitation over rotating proxies or distributed infrastructure. In its words, they "do not, on their own, attribute the activity to a single threat actor."

The six busiest addresses, defanged as published:

177.75.57[.]20
23.97.62[.]146
84.247.60[.]125
38.154.185[.]97
150.109.16[.]166
153.75.90[.]146

What site owners should do

Update Bricksforge to 4.0.1; 3.1.8.10 is the minimum fixed version. The report also recommends checking for signs of earlier abuse:

• Review incoming requests to /wp-json/bricksforge/v1/form_submit that carry a temporaryFileUploads parameter.
• Look for repeated form submissions.
• Inspect /wp-content/uploads/bricksforge/tmp/ for PHP files that have no reason to be there.

A parallel campaign: stored XSS used to plant a backdoor

The same report covers a separate case. Attackers are abusing stored cross-site scripting (CWE-79) bugs in two unrelated plugins to deliver a JavaScript payload called x.js. The NVD gives both flaws 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), whereas The Hacker News lists 7.1 for each.

• WPC Product Bundles for WooCommerce, CVE-2026-93836: versions through 8.6.6 are affected, and 8.6.7 fixes the problem. The entry point is the qty parameter. Quantity validation casts the value to a float, so a string that starts with a number passes while keeping its HTML. The markup is then stored unchanged in order item metadata under the _woosb_ids key.
• Ninja Forms, CVE-2026-94504: version 3.15.3 is affected, and 3.15.4 fixes it. Text submitted anonymously through a non-RTE textarea is displayed without safe HTML encoding in the legacy submission editor. The script runs in the WordPress admin origin when an administrator opens the attacker-known direct submission URL.

Patchstack describes x.js as a post-exploitation implant that runs inside a logged-in administrator's browser. It borrows that person's wp-admin session to install a malicious plugin, add a new administrator, trigger an extra hidden persistence mechanism and report results to attacker-controlled infrastructure.

The Hacker News says the planted plugin has an unauthenticated file manager reachable through a direct request to its main PHP file. It also creates an administrator hidden from the Users screen and a "magic login URL" that signs the holder in as the site's oldest administrator.

Updating the two plugins prevents further exploitation but does not remove an infection that is already in place, the article states. It advises owners to query the database directly for hidden administrators, check the must-use plugin directory and review web server logs.

Wordfence's Q2 2026 figures

The article also relays Wordfence data for the second quarter of 2026. It counts 2,073 published WordPress vulnerabilities, including 182 high-threat ones, a 15.2% rise from the previous quarter. About 573,000 WordPress sites were compromised in the period, a platform-wide figure that is not specific to Bricksforge.

The five most targeted vulnerabilities in that data:

Two of these depend on site configuration, according to the NVD. CVE-2019-9879 applies when new user registrations are allowed. CVE-2025-3102 applies when the plugin is active but has no API key configured.

Most attacking IP addresses came from the United States, followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland and Brazil.