Vulnerability · Web Application Security

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

October 12, 2026 · 4 min read

A CVSS 10.0 arbitrary file upload vulnerability in the Bricksforge WordPress plugin was being actively exploited before a patch even existed publicly, with Patchstack observing attack attempts starting October 7, 2026, one day before the advisory and the fixed version 3.1.8.10 were published. The flaw, tracked as CVE-2026-85097, requires no authentication, no privileges, and no user interaction, which puts every unpatched Bricksforge installation in a position where a remote attacker can upload a PHP webshell and take full control of the hosting environment. If you run WordPress at any scale, this one is worth understanding regardless of whether Bricksforge is in your stack.

What actually happened

The vulnerability lives in how Bricksforge handles its temporary file upload workflow. An attacker begins by hitting the publicly accessible bricksforge_regenerate_nonce AJAX endpoint to obtain a valid nonce. With that nonce in hand, they upload a polyglot file crafted to appear as a GIF image while also containing valid PHP code. The plugin's MIME type validation passes the file because it looks like an image at that stage. The attacker then submits a form with a crafted temporaryFileUploads parameter that points the server-side path to the already-validated file. The server executes the PHP payload. That sequence, start to finish, requires no account on the target site.

The root cause is insufficient validation of the attacker-controlled URL field in the temporaryFileUploads parameter (CWE-434, Unrestricted Upload of File with Dangerous Type). Patchstack scored it at the maximum 10.0. NVD scored it at 9.8 under CVSS v3.1. Either way, the practical outcome is the same: full remote code execution affecting confidentiality, integrity, and availability of the affected system. All versions of the Bricksforge plugin up to and including 3.1.8.9 are affected. Patchstack confirmed active exploitation in the wild and observed at least 63 unique attacking IP addresses. The fixed version is 3.1.8.10, and Patchstack deployed a virtual patch for subscribers as an interim mitigation.

Indicators to check if you run Bricksforge: review your access logs for unexpected requests to the bricksforge_regenerate_nonce and temporaryFileUploads endpoints, and audit your WordPress uploads directory for PHP files disguised as images.

Why this should matter to you even if you don’t run Bricksforge

The Bricksforge plugin may not be in your environment, but the pattern here repeats across the WordPress ecosystem with enough regularity that it warrants treating this as a category problem. WordPress plugins handle file uploads constantly, and the validation logic that separates a safe image from an executable PHP file is often thin. Attackers know this, and they scan for vulnerable plugin versions at scale. The 63 unique IPs Patchstack observed within the first day of disclosure suggests automated scanning infrastructure was already deployed before most site owners had time to read an advisory.

The broader issue is the assumption that plugins installed by a content or design team are outside the security perimeter. In many organizations, a WordPress site running a page-builder plugin like Bricksforge sits on infrastructure that shares network access with internal systems. A webshell on that host is a foothold, and lateral movement is the next step. The attack surface for a CVSS 10.0 unauthenticated RCE flaw is every network path that can reach port 443 on the affected server, which in most cases means the open internet.

The EPSS score for CVE-2026-85097 was reported at 0.31% at the time of NVD publication, which illustrates a real gap between probabilistic exploit prediction models and observed reality. Patchstack confirmed exploitation was already happening. EPSS is a useful signal but it is not a substitute for monitoring actual threat intelligence feeds and vendor advisories, especially for plugins with complex upload workflows.

The control that would have blunted it

The primary control here is prompt patching, and the operational reality is that WordPress plugin patching often gets treated as a lower-priority maintenance task compared to OS and application patching. That needs to change for any plugin that handles file uploads or AJAX endpoints accessible without authentication. For CVE-2026-85097, the vendor released version 3.1.8.10 on October 8, 2026. If you are running a managed WordPress environment, your SLA for a CVSS 10.0 flaw with confirmed active exploitation should be measured in hours.

Where patching cannot happen immediately, a web application firewall (WAF) with a virtual patch is the appropriate interim control. Patchstack deployed one for subscribers on the same day as the advisory. Most enterprise WAF vendors and CDN-layer security products support custom rules that can block requests to the specific AJAX endpoints involved in this exploit chain. It is a temporary measure that closes the window while you schedule the update. The tradeoff is that WAF rules require maintenance: if Bricksforge changes endpoint names in a future version, the rule needs to be updated too.

Cyber insurers increasingly ask about patch management programs during underwriting and at renewal. Specifically, they want to see documented SLAs that differentiate response times by severity, evidence that critical and high CVEs are tracked to closure, and a process for handling plugins and third-party components alongside first-party software. A CVSS 10.0 flaw with active exploitation is the exact scenario those SLAs need to address. If your vulnerability management program does not currently include WordPress plugins in its asset inventory and patch tracking, this incident is a reasonable prompt to fix that gap. The monitoring piece matters too, and access log review for the endpoints named above is a low-cost detection control that requires no additional tooling beyond what most hosting environments already provide.

Strondex's vulnerability management platform tracks third-party plugin CVEs alongside OS and application vulnerabilities, so your patch SLAs and closure evidence are in one place when your insurer asks.