Bricksforge WordPress Plugin: Unauthenticated File Upload RCE
CVE-2026-85097 is a CVSS 9.8 unauthenticated file upload flaw in Bricksforge for WordPress (versions through 3.1.8.9) enabling remote code execution. Under active exploitation since October 7, 2026. Patch: update to version 4.0.1.
- Vendor
- Bricksforge
- Product
- Bricksforge plugin for WordPress (through 3.1.8.9)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.3%
- Status
- exploited-in-wild
- Published
CVE-2026-85097 is a critical unauthenticated remote code execution vulnerability in the Bricksforge plugin for WordPress, affecting all versions through 3.1.8.9.
The flaw arises from inconsistent file validation: MIME types are checked during initial upload, but the plugin trusts client-supplied metadata during subsequent form submission. An unauthenticated attacker can exploit an exposed AJAX endpoint to obtain a valid nonce, then submit crafted form data referencing a polyglot file with a PHP-executable extension, resulting in arbitrary code execution on the server.
Patchstack documented active exploitation beginning October 7, 2026, involving 63 distinct source IPs. The vendor patched the issue in version 3.1.8.10; the current release is 4.0.1. Sites running affected versions should update immediately.
Mitigation: Update Bricksforge to version 4.0.1 or later via the WordPress plugin dashboard.
