The short answer
If your WordPress site uses the Bricksforge plugin, update it today. A maximum-severity vulnerability, tracked as CVE-2026-85097, lets attackers take over a vulnerable site without logging in. Attackers started exploiting it within hours of its discovery, and every internet-connected site running an affected version is a target. The fix is simple: update Bricksforge to at least version 3.1.8.10, or to the latest 4.0.1 release.
What is Bricksforge?
Bricksforge is a popular paid add-on for Bricks, the visual page builder many agencies and marketing teams use to build client sites. It extends Bricks with advanced forms, animations, dynamic data tools, and backend customization features. Because it is designed to save time on professional projects, it tends to run on exactly the kind of sites that can least afford to be hacked: client work, marketing funnels, and business pages that generate real revenue.
The vulnerability: CVE-2026-85097
The flaw carries a perfect CVSS score of 10.0, the highest possible rating. It affects Bricksforge versions up to and including 3.1.8.9. The vendor fixed it in version 3.1.8.10, and later released version 4.0.1 with additional hardening for the plugin’s Pro Forms feature.
The root cause is a validation gap in how the plugin handles file uploads. When a file is first uploaded, Bricksforge checks its MIME type, which is the correct thing to do. But when the associated form is submitted, the plugin trusts metadata supplied by the client, including a URL field inside a parameter called temporaryFileUploads. That trusted metadata is the hole attackers drive through.
How the attack works
Security researchers at Patchstack, who first spotted the attacks, describe an attack sequence that needs no login and no user interaction:
- The attacker calls an unauthenticated AJAX endpoint,
bricksforge_regenerate_nonce, to get a valid nonce. - They upload a polyglot file: a GIF image header with valid PHP code hidden inside. It passes the MIME type check and lands in a temporary directory under
wp-content/uploads/bricksforge/tmp/. - They submit a form with a crafted
temporaryFileUploadsobject. One part of the object points to the innocent-looking GIF. The other part sets a destination URL ending in.php,.PHP,.php5, or a URL-encoded variant. - Bricksforge trusts the client-controlled data, moves the file to the PHP destination, and the attacker’s code is live. One request to that location later, there is a working web shell on the server.
Attackers are also trying extension filters with different capitalizations and encoding tricks to slip past partial fixes, so updating to the fixed version is the only reliable response.
Active exploitation is already happening
Patchstack first detected live exploitation attempts on October 7, 2026, at 21:47 UTC, and the pace has only accelerated since. The activity looks organized: in one cluster, 44 IP addresses fired 56 identical payloads within seconds, and three IP addresses tested 25 different PHP extension and encoding combinations against the same temporary file. Researchers saw 63 unique source addresses in the early logs, with just six of them driving nearly half the traffic.
Attackers are hitting two routes: the plugin’s REST API endpoint at /wp-json/bricksforge/v1/form_submit and the legacy admin-ajax.php endpoint using the bricksforge_form_submit action. If you run Bricks-based sites, scan your access logs for repeated form submissions, the string temporaryFileUploads, and any unexpected PHP files inside the Bricksforge temporary upload folder.
Why this one is especially dangerous
Zero-authentication remote code execution is about as bad as it gets, and three details make this case worse. First, Bricksforge has a history: earlier this year the plugin suffered multiple high-severity issues including unauthenticated privilege escalation and information disclosure, which suggests the code around its Pro Forms feature needs the hardening 4.0.1 brings. Second, sites built with page builders expose public-facing forms that now double as attack surfaces. Third, commercial plugins sometimes sit behind license checks or manual update flows, so a meaningful number of the roughly 6,000 active installations are probably still unpatched.
October has already been rough for unpatched software. Just days earlier, a CVSS 10.0 flaw in SonicWall’s SMA 1000 started seeing exploitation attempts two days after its patch, and GitLab shipped an emergency fix for a critical RCE in self-managed servers. Attackers are clearly hunting newly disclosed flaws and working them fast.
What to do right now
If you manage WordPress sites, do these three things today:
- Update Bricksforge to at least 3.1.8.10, ideally 4.0.1. That closes the arbitrary file upload path. If you cannot update immediately, temporarily deactivate the plugin or add WAF rules blocking the vulnerable endpoints.
- Hunt for signs of compromise. Look for PHP files that do not belong in
wp-content/uploads/bricksforge/tmp/and search logs forform_submitandtemporaryFileUploadshits from unfamiliar IPs. - Review the whole plugin stack. Patchstack reports that attackers are also exploiting XSS flaws in WPC Product Bundles for WooCommerce (CVE-2026-93836) and Ninja Forms (CVE-2026-94504) to plant backdoor plugins and rogue admin accounts. Check for unexpected admin users and files in the
mu-pluginsdirectory as a general habit.
Patchstack’s RapidMitigate service deployed a virtual patch for its protected customers before the first public attacks registered, which confirms the window between disclosure and exploitation was measured in hours, not days. If you have not patched yet, assume you are on borrowed time.
Frequently asked questions
Is my site affected if I use Bricks builder but not Bricksforge?
No. The flaw is in the Bricksforge add-on, not in Bricks itself. If you have never installed Bricksforge, this specific vulnerability does not apply to you.
Which Bricksforge versions are vulnerable?
Versions up to and including 3.1.8.9 are vulnerable. The issue was fixed in 3.1.8.10, and the current release is 4.0.1, which includes further hardening.
Does the attacker need an account on my site?
No. Exploitation is unauthenticated. The attacker only needs your site to be reachable on the internet and to send a few crafted requests.
What should I check to see if I was already hacked?
Inspect wp-content/uploads/bricksforge/tmp/ for files with PHP extensions, review web server logs for the temporaryFileUploads parameter and repeated submissions to the /wp-json/bricksforge/v1/form_submit endpoint, and look for new or renamed admin accounts in WordPress. If you find evidence of a compromise, restore from a known-clean backup and rotate all credentials.
How is this different from the Ninja Forms and WPC Product Bundles attacks?
Those are separate, concurrently active campaigns exploiting cross-site scripting flaws to plant backdoor plugins and hidden administrator accounts. They carry CVSS 7.1 scores. The Bricksforge flaw is more severe: unauthenticated arbitrary file upload leading straight to remote code execution.