Attackers are actively exploiting a maximum-severity vulnerability in the Bricksforge plugin for WordPress that can allow unauthenticated users to upload and execute arbitrary PHP code on vulnerable websites, according to security researchers.
The flaw, tracked as CVE-2026-85097, carries a CVSS score of 10.0 and affects Bricksforge versions up to and including 3.1.8.9. A fix was released in version 3.1.8.10, while users have been advised to update to the latest available version, 4.0.1.
Bricksforge is a WordPress plugin designed to extend the Bricks visual website builder with features including animations, advanced forms and scrolling video sequences.
Patchstack said it detected active exploitation attempts targeting the vulnerability on October 7, 2026, at 9:47 p.m. UTC.
Flaw Allows Attackers to Turn Image Uploads Into PHP Payloads
The vulnerability stems from insufficient validation of file metadata during form submission. While Bricksforge checks a file’s MIME type when it is initially uploaded, researchers found that the plugin later trusts metadata supplied by the client, including a URL field inside the temporaryFileUploads parameter.
An attacker can first obtain a valid nonce through an unauthenticated AJAX endpoint and then upload a file designed to function both as an image and as PHP code. The file can pass the initial MIME-type check and be stored in the plugin’s temporary upload directory.
The attacker can then submit a form in which the server-side file path refers to the validated image while the associated URL ends with a PHP extension. Bricksforge may then place the file contents at the PHP location, allowing the embedded code to execute when the file is requested.
Wordfence described a similar exploitation path, noting that an attacker can use a GIF or PNG file for the validated upload while directing the URL to a PHP payload.
Successful exploitation could allow attackers to execute arbitrary PHP code on the server. This could potentially be used to take control of a WordPress site, deploy web shells, access sensitive data or establish persistent access.
Patchstack said attackers have targeted the Bricksforge REST API form submission endpoint as well as the WordPress admin-ajax.php endpoint using crafted temporaryFileUploads parameters.
Researchers also observed attempts to bypass extension filtering through alternate PHP extensions, different capitalisation patterns and encoded file extensions.
Exploitation Seen From 63 Source IP Addresses
Patchstack said the exploitation activity showed signs of automation and distributed infrastructure.
In one cluster, 44 IP addresses reportedly sent 56 requests carrying identical payloads within seconds. In another, three IP addresses tested 25 variations of PHP extensions and encodings against the same temporary file.
The company said the patterns were consistent with automated exploitation using rotating proxies or distributed systems, but did not by themselves identify a single threat actor.
The activity was recorded from 63 unique source IP addresses. Six addresses accounted for about 46% of the observed requests.
Site administrators have been advised to review incoming requests to the Bricksforge form submission endpoint containing the temporaryFileUploads parameter. They should also look for repeated form submissions and unexpected PHP files in the plugin’s temporary uploads directory.
Updating the plugin remains the primary mitigation against further exploitation.
Other WordPress Plugins Also Targeted in Active Campaigns
The Bricksforge disclosure comes as attackers are also exploiting cross-site scripting vulnerabilities in WPC Product Bundles for WooCommerce and Ninja Forms.
The flaws, tracked as CVE-2026-93836 and CVE-2026-94504, each carry a CVSS score of 7.1. According to Patchstack, attackers are using them to deliver a JavaScript payload capable of installing a backdoor plugin and creating rogue administrator accounts.
The malicious implant can reportedly abuse the authenticated session of a logged-in WordPress administrator to install a plugin, create a hidden administrator account, establish additional persistence and report the results to attacker-controlled infrastructure.
The affected plugins have received security updates, but researchers warned that installing a patched version does not remove an existing compromise. Administrators may need to check the WordPress database for hidden accounts, inspect the must-use plugin directory and review server logs for evidence of previous exploitation.
Wordfence reported 2,073 WordPress-related vulnerabilities during the second quarter of 2026. The number of high-threat vulnerabilities increased 15.2% from the previous quarter to 182, while around 573,000 WordPress sites were reported compromised during the period.
The most frequently targeted vulnerabilities included flaws affecting LiteSpeed Cache, WPGraphQL, Frontend File Manager, WooCommerce Payments and SureTriggers. Wordfence said strong firewall protection, timely patching, hardened configurations, scanning and real-time alerts remain important measures for limiting exposure to WordPress attacks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
