CVE-2026-85097
CVSS 9.8 CRITICAL: the Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. EPSS 0.3% (22nd percentile).
Vulnerabilities & Exploits · Web App Attack
Patchstack said attackers were actively exploiting CVE-2026-85097 in Bricksforge on October 7, targeting versions 3.1.8.9 and earlier of the WordPress plugin. The flaw lets an unauthenticated attacker upload and run PHP on a site, which turns a form upload bug into remote code execution.
The bug is in how Bricksforge checks files. It verifies the upload’s MIME type when the file first arrives, then later trusts client-supplied file metadata during form submission instead of re-checking the real file path. That split lets a file that passed as an image be treated as a PHP file later, so the embedded code runs when the server serves it.
For WordPress sites that accept public file uploads through Bricksforge forms, the exposure sits at the web host level: successful exploitation can hand over the site, not just a single upload field. The report still points to a narrow product path, but the failure mode is the same class of trust break that can turn any two-step upload flow into code execution.
2 sources · Oct 12
CVSS 9.8 CRITICAL: the Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. EPSS 0.3% (22nd percentile).
SecurityWeek
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.
originalThe Hacker News
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Bricksforge's CVE-2026-85097 is under active exploitation and allows unauthenticated PHP execution on affected WordPress sites.
originalPart of the PlainSec briefing for 2026-10-12
Every edition of this story: Bricksforge upload flaw turns form files into PHP