Active Attacks Target WordPress Add-On Through Unrestricted PHP Execution
Security researchers have identified active exploitation of CVE-2026-85097, a severe vulnerability in the Bricksforge plugin for WordPress that allows unauthenticated attackers to upload malicious files and execute PHP code on vulnerable websites.
The flaw affects Bricksforge versions 3.1.8.9 and earlier. Security company Patchstack first observed exploitation attempts on October 7, 2026, and disclosed its findings the following day.
A security fix is available in version 3.1.8.10, while the newer 4.x release line also includes remediation.
Improper File Validation Enables Server Compromise
Bricksforge extends the Bricks website builder with advanced forms, animations, and customization capabilities.
The vulnerability originates in how its form-processing functionality handles temporary file uploads.
Malicious Images Bypass Initial Security Checks
During the initial upload, Bricksforge validates a file's MIME type. However, subsequent form submissions trust client-controlled metadata within thetemporaryFileUploadsparameter.
Attackers can exploit this inconsistency by submitting a specially crafted image containing embedded PHP code.
Although the file passes the initial image validation, manipulated metadata can cause the application to save its contents under a PHP-compatible filename.
When accessed through the web server, the resulting file may execute attacker-controlled code, potentially enabling website takeover, data theft, and persistent unauthorized access.
Exploitation Attempts Show Coordinated Automation
Patchstack's monitoring identified malicious requests targeting the plugin's form-submission functionality.
Dozens of IP Addresses Linked to Attack Traffic
Researchers observed activity originating from 63 unique IP addresses, with six responsible for approximately 46% of recorded requests.
One cluster involved 44 IP addresses submitting 56 identical requests within seconds. Another tested 25 variations involving file extensions and encoding techniques.
Attackers experimented with alternative PHP extensions, capitalization changes, and URL encoding to bypass file-handling restrictions.
These patterns suggest automated exploitation through distributed infrastructure, although no specific threat actor has been identified.
Website Administrators Urged to Apply Fixes
Successful exploitation could allow attackers to install web shells, modify website content, steal information, or establish persistent access.
Security Teams Should Investigate Suspicious Uploads
Administrators should immediately update Bricksforge to a patched release, preferably the latest supported version.
Security teams should also examine requests to/wp-json/bricksforge/v1/form_submit, particularly those containing suspicioustemporaryFileUploadsmetadata.
Additional checks should cover the/wp-content/uploads/bricksforge/tmp/directory and other upload locations for unexpected PHP files.
Organizations unable to update immediately can consider Patchstack's RapidMitigate protection while preparing remediation.
Because exploitation attempts have already been observed, installing the update alone may be insufficient for previously exposed websites.
Administrators should also investigate potential compromise and unauthorized changes.