A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.
The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The security flaw impacts Bricksforge versions up to and including 3.1.8.9. Patches have been released in version 3.1.8.10.
Bricksforge is a WordPress plugin that's advertised as a "Swiss Army knife" for Bricks, a visual website-building tool for WordPress, with support for animations, advanced forms, and scrolling video sequences.
WordPress security company Patchstack said it detected exploitation efforts targeting the flaw on October 7, 2026, at 9:47 p.m. UTC.
"Bricksforge validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends," Patchstack said. "In particular, it does not validate the 'url' field inside the 'temporaryFileUploads' parameter."
At a high level, the vulnerability stems from insufficient validation of a URL field in the 'temporaryFileUploads' parameter during form submission. An attacker could exploit this loophole to achieve RCE through four steps -
- Request a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint.
- Upload a GIF/PHP polyglot: a file that is a valid image but also contains PHP code. It passes the MIME check and lands in the temporary upload directory.
- Submit a form where the 'file' path points to that validated image, but the 'url' ends in a PHP extension.
- Bricksforge implicitly trusts the submitted metadata and places the file's contents at the PHP location, leading to the execution of the embedded code when that file is requested.
"An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed," Wordfence said in an advisory for the flaw.
"Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension."
Successful exploitation of the flaw could result in arbitrary PHP execution on the server, which an attacker can leverage to seize control of the WordPress site, deploy web shells, read sensitive data, and establish persistent access.
In the attacks observed by Patchstack, threat actors have been observed targeting the Bricksforge REST API form submission endpoint ("/wp-json/bricksforge/v1/form_submit") or the "/wp-admin/admin-ajax.php" endpoint with "bricksforge_form_submit" action along with a crafted "temporaryFileUploads" parameter.
A representative request is as follows -
{
"temporaryFileUploads": [
{
"field": "form-field-file",
"file": {
"file": "/var/www/example.com/wp-content/uploads/bricksforge/tmp/img_example.gif",
"url": "https://example.com/wp-content/uploads/bricksforge/tmp/img_example.php",
"type": "image/gif"
}
}
]
}As specified by Wordfence, threat actors are exploiting a mismatch where the specified "file" argument is a GIF (or a PNG) file, while the actual URL points to a PHP payload.
To get around extension filtering, the exploitation activity makes use of alternate PHP extensions (e.g., .php5, .php7, or .phtml), case manipulation (e.g., .PHP, .Php, or .pHp), and encoded extensions (e.g., .%70hp, %2ephp, or .%2570%2568%2570).
"Two clusters stand out in our telemetry. In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other," Patchstack said. "In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file."
"Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor."
The activity has been recorded from 63 unique source IPs, with six of them accounting for roughly 46% of all requests -
- 177.75.57[.]20
- 23.97.62[.]146
- 84.247.60[.]125
- 38.154.185[.]97
- 150.109.16[.]166
- 153.75.90[.]146
Users are advised to update to the latest version of the plugin (4.0.1) to mitigate the threat. Site owners are recommended to audit incoming requests to the "/wp-json/bricksforge/v1/form_submit" endpoint that contain a "temporaryFileUploads" parameter, as well as repeated form submissions and unexpected PHP files in "/wp-content/uploads/bricksforge/tmp/."
WPC Product Bundles for WooCommerce and Ninja Forms Flaws Exploited
The disclosure comes as threat actors are also abusing cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS score: 7.1) and Ninja Forms (CVE-2026-94504, CVSS score: 7.1), to deliver a JavaScript payload ("x.js") capable of deploying a backdoor plugin and creating rogue admin accounts.
The plugin features an unauthenticated file manager accessible through a direct request to the plugin's main PHP file. It also creates a WordPress administrator hidden from the Users screen and installs a magic login URL, which authenticates the holder as the site's oldest administrator.
"It is a WordPress post-exploitation and persistence implant designed to execute inside the browser of a logged-in administrator," Patchstack said. "Once triggered, it abuses the victim's authenticated wp-admin session to install a malicious WordPress plugin, create a new administrator account, invoke an additional hidden persistence mechanism, and report the results to attacker-controlled infrastructure."
It's worth emphasizing that while updating the vulnerable plugins (version 8.6.7 for WPC Product Bundles for WooCommerce and version 3.15.4 for Ninja Forms) prevents further exploitation, it does not remove an existing infection. It's essential that site owners audit for hidden administrators by directly querying the database, check the must-use plugin directory, and review web server logs.
WordPress Exploitation Trends in Q2 2026
According to data from Wordfence, a total of 2,073 WordPress-related vulnerabilities were published in the second quarter of 2026, with the number of high-threat flaws jumping 15.2% from the previous quarter to 182. About 573,000 WordPress sites were compromised during the time period.
The top five vulnerabilities targeted by attackers are listed below -
- CVE-2024-28000 (CVSS score: 9.8) - LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation
- CVE-2019-9879 (CVSS score: 9.8) - WPGraphQL <= 0.2.3 - Administrative User Creation
- CVE-2016-15042 (CVSS score: 9.8) - Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload
- CVE-2023-28121 (CVSS score: 9.8) - WooCommerce Payments 4.8.0 - 5.6.1 Authentication Bypass and Privilege Escalation
- CVE-2025-3102 (CVSS score: 8.1) - SureTriggers <= 1.0.78 - Unauthenticated Administrative User Creation
The vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.
"A strong firewall, timely vulnerability patches, and hardened configurations help block malicious traffic before it ever reaches your site," Wordfence said. "Comprehensive scanning helps identify vulnerabilities, malware, or suspicious changes on your site that could signal an attempted compromise. Real-time alerts about critical events, login attempts, and file changes help you stay ahead of threats."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.