Bricksforge Plugin Flaw Gets Exploited Days After Patch

Attackers started exploiting a critical remote code execution flaw in the Bricksforge WordPress plugin on October 7, less than a day after Patchstack documented the issue. The campaign involved 63 distinct source IP addresses, with six of them accounting for about 46% of all exploitation attempts, according to Patchstack’s disclosure.

The flaw, CVE-2026-85097, carries a CVSS score of 9.8 and affects Bricksforge versions up to and including 3.1.8.9. It sits in the plugin’s form submission handling. During the initial file upload, MIME types are validated. During the subsequent form submission, the plugin trusts file metadata supplied by the client. That mismatch lets an attacker upload a file that passes initial checks, then direct it to execute as PHP on the server.

No authentication is required to reach the vulnerable code path. An unauthenticated AJAX endpoint in the plugin exposes nonces that attackers can obtain before submitting crafted form data referencing a specially constructed file.

Patchstack logged the first exploitation at 9:47 p.m. UTC on October 7. Six IP addresses drove nearly half the traffic, which suggests at least part of the campaign is coordinated rather than purely opportunistic scanning. A zero-authentication entry point in a popular page builder plugin tends to attract automated tools within hours of any public writeup.

Bricksforge fixed the issue in version 3.1.8.10. The current release is 4.0.1, and the Bricksforge version changelog confirms the patch. Any site running version 3.1.8.9 or earlier should update.

October has been a rough month for WordPress plugin security. Critical RCE flaws have appeared in SiteVault, Everest Backup, and WooCommerce-adjacent plugins within the same week. The setup is the same each time: user-controlled input, inadequate validation, a code path to the filesystem or database. The CVE numbers change. The architecture doesn’t.