Critical Bricksforge WordPress flaw exploited since October 7

A critical vulnerability in Bricksforge, a commercial WordPress plugin, has been exploited by attackers since October 7, according to the security company Patchstack. Tracked as CVE-2026-85097, it allows an unauthenticated visitor to upload a file to the server and then execute code on it. The attacker can then take full control of the site. Version 3.1.8.10 fixes the problem. All versions up to and including 3.1.8.9 are vulnerable.

What we know

Bricksforge extends the Bricks site builder with forms, animations and an email editor. About 6,000 sites use it, according to Patchstack, as cited by SecurityWeek. Patchstack rates the severity 10 out of 10, while SecurityWeek reports a CVSS score of 9.8 without specifying where it comes from.

According to Patchstack's analysis published on October 8, the plugin does check the file type during upload. However, it trusts the information sent by the browser when the form is submitted. An attacker can therefore send a booby-trapped image that also contains PHP code, then have it saved under a .php name before executing it.

Patchstack observed the first attempt on October 7 at 9:47 p.m. (UTC). The company recorded requests from 63 IP addresses. In one episode, 44 addresses sent 56 identical requests within seconds. Patchstack says this points to automated exploitation, but it does not attribute the activity to any known group.

What to do

• Update Bricksforge to version 3.1.8.10 or later. Check that your license allows you to receive updates.
• If you cannot update right away, deactivate the plugin or block the targeted requests at the web application firewall level. Patchstack offers a dedicated rule.
• Search your logs for POST requests to /wp-json/bricksforge/v1/form_submit, or to /wp-admin/admin-ajax.php with the actions bricksforge_form_submit and bricksforge_regenerate_nonce.
• Check your upload directories: no PHP file should be in /wp-content/uploads/bricksforge/tmp/ or in /wp-content/uploads/2026/10/. Patchstack specifically reports files named login_admin_*.php.
• If the site ran unprotected with a vulnerable version, review the log history. Also look for any unauthorized changes or backdoors left on the server.