Attackers are exploiting a critical flaw in Bricksforge, a WordPress plugin that extends the Bricks page builder. Anyone on the internet can use it to upload a file of their choice and run it as code, without logging in. The fix is in Bricksforge 3.1.8.10.
What happened?
On 8 October the security firm Patchstack reported that CVE-2026-85097 in Bricksforge is being exploited. It saw the first attack attempt at 21:47 UTC on 7 October. Patchstack’s summary is blunt: “Our telemetry shows active exploitation attempts targeting Bricksforge installations”.
The severity scores differ slightly. Patchstack rates the flaw 10.0 out of 10. Wordfence, whose score appears on the official CVE record, rates it 9.8 (CVSS v3.1). Both put it in the critical range.
According to the vendor’s changelog, the flaw is fixed in 3.1.8.10 and in 4.0.0.
How does the attack work?
The problem is in how Bricksforge handles file uploads in its forms. The plugin checks the file type when a file arrives, but later trusts details sent by the visitor’s browser. An attacker can upload a file that looks like an image but contains PHP code, then have it moved to a place where the server runs it.
The one-time check code (nonce) the attack needs can be obtained without logging in. So an unpatched site that is reachable from the internet is enough.
Patchstack logged attempts from 63 different IP addresses, with the six busiest sending about 46% of requests. One group of 44 addresses sent 56 identical requests, while another tried 25 variations against the same file. The activity is automated and not attributed to any single group.
Who is affected?
Any WordPress site running Bricksforge 3.1.8.9 or older. On the 4.x line, version 4.0.1, released on 8 October, fixed a security issue in the Pro Forms file upload that, according to the vendor, “affects every site with Pro Forms active”, including sites whose forms have no upload field.
Bricksforge is a paid plugin sold on the vendor’s own website. It may therefore not update the same way as plugins installed from the WordPress.org directory. If an agency built your site, you may not even know it is installed.
What to do now
- Ask your web agency or developer whether your site uses Bricksforge, and which version.
- Update Bricksforge to 3.1.8.10 or later, or to 4.0.1 if you are on the 4.x line. A firewall rule, such as the one Patchstack offers, can block attempts in the meantime but does not replace the update.
- Have the server checked for planted files. Updating closes the hole but does not remove anything already uploaded through it. Patchstack advises looking for PHP files in
wp-content/uploads/bricksforge/tmp/and other upload folders, especially files namedlogin_admin_*.php. - Ask your developer to review the server logs for form submissions that pair an image file path with a PHP destination.
- If you find unknown files, assume the site has been broken into. Restore it from a clean backup, change all passwords and report it to CERT-EE (cert@cert.ee). If you need help, see how we handle incidents.
How to avoid the next one
Paid add-ons are easy to forget, because they often sit outside the update routine that covers everything else. Keep a list of every plugin on your site and agree with your developer who updates them and how quickly.
If you are not sure what is running on your site, our website security check can tell you.
Sources
- Patchstack: Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
- NVD: CVE-2026-85097
- Bricksforge: Version changelog
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
