Critical Bricksforge WordPress Plugin Flaw Under Active Attack: Unauthenticated Remote Code Execution Possible

What is the Bricksforge Vulnerability?

A critical security flaw (CVE-2026-85097) has been discovered in the Bricksforge plugin for WordPress. This plugin is marketed as a versatile tool for building and enhancing WordPress sites. According to The Hacker News↗ (opens in a new tab), the vulnerability has a maximum CVSS score of 10.0, meaning it is as severe as possible. Attackers can exploit this flaw to upload and run their own code on affected websites, even if they are not logged in.

The flaw affects Bricksforge versions up to and including 3.1.8.9. A fix has been released in version 3.1.8.10, and users are urged to update to the latest version (4.0.1) as soon as possible.

How Are Attackers Exploiting the Flaw?

The attack begins when an unauthenticated attacker requests a valid nonce (a one-time token used to prevent certain attacks) from a public Bricksforge AJAX endpoint. The attacker then uploads a specially crafted file known as a GIF/PHP polyglot. This file is both a valid image and contains hidden PHP code. Because Bricksforge only checks the file type at upload, the file passes the initial test.

Next, the attacker submits a form with manipulated metadata. They set the file path to the uploaded image, but the URL field points to a PHP file extension. Bricksforge trusts the submitted metadata and moves the file to a location where the PHP code can be executed. This allows the attacker to run any code they want on the server, giving them full control over the site.

Attackers have been observed using various tricks to bypass file extension filters, such as using alternate extensions (.php5, .phtml), changing the case (.PHP, .Php), or encoding the extensions (.%70hp, %2ephp). Automated attacks from dozens of IP addresses have been detected, with some clusters sending many requests in a short time, suggesting the use of bots or distributed infrastructure.

What Can Attackers Do Once In?

With remote code execution (RCE), attackers can:

• Take over the WordPress site
• Install web shells (tools for ongoing access)
• Read sensitive data
• Create hidden administrator accounts
• Set up persistent backdoors

There are also reports of attackers installing malicious plugins, creating hidden admin users, and setting up special login URLs that give them ongoing access.

What Should Site Owners Do?

1. Update Immediately: Upgrade Bricksforge to version 4.0.1 or later. This closes the vulnerability for future attacks.
2. Check for Signs of Compromise: Look for unexpected PHP files in the /wp-content/uploads/bricksforge/tmp/ directory. Audit requests to the /wp-json/bricksforge/v1/form_submit endpoint with the temporaryFileUploads parameter.
3. Hunt for Persistence: Check for hidden administrator accounts by querying the WordPress database directly. Review the must-use plugin directory and web server logs for suspicious activity.
4. Remove Malicious Files: Updating the plugin does not remove any backdoors or malicious files already installed. Manual cleanup is required if a site has been compromised.

Wider Context: WordPress Under Attack

WordPress plugins are a common target for attackers. In the second quarter of 2026, over 2,000 WordPress-related vulnerabilities were published, with more than half a million sites compromised, according to The Hacker News↗ (opens in a new tab). Attackers often use automated tools to scan for and exploit vulnerable sites as soon as flaws are disclosed.

What Happens Next?

As this report is based on a single secondary source, details may change as more information becomes available. Site owners should stay alert for updates from Bricksforge and WordPress security firms. Immediate patching and careful review of affected sites are the best defences against this type of attack.