CVE-2026-85097 — rated CVSS 10.0 — allows unauthenticated attackers to upload and execute arbitrary PHP on sites running vulnerable versions of the Bricksforge WordPress plugin, security firms say.
CVE-2026-85097: how the Bricksforge flaw becomes remote code execution
The Bricksforge plugin, described by vendors as a “Swiss Army knife” for the Bricks page builder, contains an input-validation gap that attackers are exploiting to achieve unauthenticated remote code execution (RCE). Patchstack and Wordfence describe the flaw as an insufficient validation of a URL field inside the temporaryFileUploads parameter during form submission. Patchstack explained: "Bricksforge validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends." The flaw affects Bricksforge versions up to and including 3.1.8.9; a patch was released in 3.1.8.10 and users are advised to update to the latest plugin release (4.0.1).
The exploitation chain, as described by researchers, is four steps: obtain a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint; upload a GIF/PHP polyglot that passes MIME checks and lands in the temporary upload directory; submit a form where the server-side "file" path points to the validated image while the attacker-controlled "url" ends with a PHP extension; and rely on Bricksforge trusting the submitted metadata, which causes the file to be written at a PHP-accessible location and executed when requested.
Observed exploitation: endpoints, timing, and source IPs
Patchstack detected exploitation attempts on October 7, 2026 at 9:47 p.m. UTC. Attackers have targeted the Bricksforge REST API form submission endpoint ("/wp-json/bricksforge/v1/form_submit") and the legacy AJAX endpoint ("/wp-admin/admin-ajax.php" with the "bricksforge_form_submit" action), submitting crafted temporaryFileUploads parameters to push PHP payloads into web-accessible paths.
Patchstack recorded activity from 63 unique source IPs. Six IPs accounted for roughly 46% of requests: 177.75.57[.]20, 23.97.62[.]146, 84.247.60[.]125, 38.154.185[.]97, 150.109.16[.]166, and 153.75.90[.]146. Two attack clusters stood out: one with 44 IPs sending 56 identical requests within seconds, and another with three IPs testing 25 variations of PHP extensions and encodings against the same temporary file. Patchstack noted that "Both patterns point to automated exploitation over rotating proxies or distributed infrastructure."
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTechniques to bypass extension filters: polyglots, encodings and case tricks
Attackers use GIF/PHP polyglot files—valid images that also contain embedded PHP—to pass server-side MIME checks on upload and then trick the form-submission logic into writing the same bytes to a .php location. To evade simple extension filters, attackers test alternate PHP extensions (for example, .php5, .php7, .phtml), case variations (.PHP, .Php) and encoded forms (.%70hp, %2ephp, .%2570%2568%2570). Wordfence summarized the exploitation pattern: an attacker uploads a GIF/PHP polyglot to the temporary upload directory and then submits a form where the server-side file path points to the validated GIF file but the attacker-controlled url field ends with a .php extension.
WPC Product Bundles and Ninja Forms: XSS as a persistence vector
The Bricksforge activity arrives alongside active abuse of two XSS flaws used to deliver a JavaScript payload named "x.js." Patchstack links CVE-2026-93836 (WPC Product Bundles for WooCommerce, CVSS 7.1) and CVE-2026-94504 (Ninja Forms, CVSS 7.1) to attacks that load x.js in administrator browsers.
Patchstack described the resulting implant as a post‑exploitation persistence mechanism: the vulnerable plugin provides an unauthenticated file manager and creates a WordPress administrator hidden from the Users screen, plus a “magic login URL” that authenticates the holder as the site's oldest administrator. "It is a WordPress post-exploitation and persistence implant designed to execute inside the browser of a logged-in administrator," Patchstack said. Once triggered, the script abuses the authenticated wp-admin session to install a malicious plugin, create an administrator account, invoke an additional hidden persistence mechanism, and report results to attacker infrastructure.
Patchstack cautioned that updating the vulnerable plugins (WPC Product Bundles to at least 8.6.7 and Ninja Forms to at least 3.15.4) prevents further exploitation but does not remove an existing infection; site owners must audit for hidden administrators by directly querying the database, check the must-use plugin directory, and review web server logs.
What this means for site owners and security teams
- Site owners: Update Bricksforge to the latest release (4.0.1) immediately. Audit incoming requests to /wp-json/bricksforge/v1/form_submit and look for submissions containing temporaryFileUploads, repeated form submissions, and unexpected PHP files under /wp-content/uploads/bricksforge/tmp/.
- Security teams and administrators: Assume automated probing and distributed exploitation when you see clustered, variant requests; review logs for the six heavy-hitter IPs noted above and block or investigate suspicious patterns. For sites potentially impacted by WPC Product Bundles or Ninja Forms XSS, query the database for hidden administrator accounts, inspect the must-use plugin directory, and scan for installed web shells or rogue plugins—updates alone do not cure persistent implants.
Wordfence added defensive guidance: "A strong firewall, timely vulnerability patches, and hardened configurations help block malicious traffic before it ever reaches your site," and recommended comprehensive scanning and real-time alerts to detect compromises early.
Attack telemetry shows an opportunistic, automated effort to weaponize a single validation bug into full site takeover. The immediate steps are clear: patch Bricksforge, search uploads and logs for unexpected PHP files, and verify there are no hidden administrator accounts or persistence mechanisms created by the broader XSS campaigns.
