Bricksforge RCE flaw exploited since October 7

Bricksforge checks a file’s MIME type when it is first uploaded, and gets that part right. The problem shows up on the next request. When a form is submitted, the plugin trusts the file metadata the client sends and never validates the url field inside the temporaryFileUploads parameter. That gap is CVE-2026-85097, a CVSS 10.0 that lets an unauthenticated attacker write and execute arbitrary PHP on any WordPress site running the plugin. Patchstack says it is under active exploitation, with the first attempts logged on October 7, 2026 at 9:47 p.m. UTC.

Bricksforge is an add-on for Bricks, the visual site builder, sold as a Swiss Army knife for animations, advanced forms, and scrolling video sequences. Versions up to and including 3.1.8.9 are vulnerable. The fix landed in 3.1.8.10, and the current release is 4.0.1.

How the upload becomes code execution

The chain runs in four steps:

1. Pull a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint.
2. Upload a GIF/PHP polyglot, a file that is a valid image and also carries PHP code. It passes the MIME check and lands in the temporary upload directory.
3. Submit a form whose file path points at that validated image while the url field ends in a PHP extension.
4. Bricksforge trusts the submitted metadata, writes the file’s contents to the PHP location, and the embedded code runs when that path is requested.

The observed traffic hits either the REST endpoint /wp-json/bricksforge/v1/form_submit or /wp-admin/admin-ajax.php with the bricksforge_form_submit action, carrying a crafted temporaryFileUploads parameter. A representative payload names a .gif for the file field and a matching .php URL:

{
  "temporaryFileUploads": [
    {
      "field": "form-field-file",
      "file": {
        "file": "/var/www/example.com/wp-content/uploads/bricksforge/tmp/img_example.gif",
        "url": "https://example.com/wp-content/uploads/bricksforge/tmp/img_example.php",
        "type": "image/gif"
      }
    }
  ]
}

Because some setups filter on extension, the attempts try alternates like .php5, .php7, and .phtml, case variants like .PHP, .Php, and .pHp, and encoded forms like .%70hp, %2ephp, and .%2570%2568%2570.

Patchstack describes two clusters in its telemetry. In one, 44 IPs sent 56 near-identical requests within seconds of each other. In the other, three IPs ran 25 extension and encoding variations against the same temporary file. The activity spans 63 unique source IPs, with six responsible for roughly 46% of requests: 177.75.57.20, 23.97.62.146, 84.247.60.125, 38.154.185.97, 150.109.16.166, and 153.75.90.146. Both patterns look like automated exploitation over rotating proxies or distributed infrastructure, which Patchstack is careful not to pin on a single actor.

Update to 4.0.1. If you cannot patch immediately, or want to know whether you were already hit, audit requests to /wp-json/bricksforge/v1/form_submit that carry a temporaryFileUploads parameter, watch for repeated form submissions, and look for unexpected PHP files in /wp-content/uploads/bricksforge/tmp/. Successful exploitation hands over full site control: web shells, data reads, and access.

Two more plugins, same goal

At the same time, attackers are abusing stored XSS in two unrelated plugins, WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS 7.1) and Ninja Forms (CVE-2026-94504, CVSS 7.1), to deliver a JavaScript payload (x.js) that runs inside a logged-in administrator’s browser. From that authenticated wp-admin session it installs a malicious plugin, creates a new administrator account, invokes a hidden persistence mechanism, and reports back to attacker-controlled infrastructure. The backdoor plugin exposes an unauthenticated file manager through a direct request to its main PHP file, hides its administrator from the Users screen, and installs a magic login URL that authenticates whoever holds it as the site’s oldest administrator.

Updating to version 8.6.7 for WPC Product Bundles and 3.15.4 for Ninja Forms stops further exploitation, but it does not remove an existing infection. If you were running a vulnerable version, check for hidden administrators by querying the database directly, inspect the must-use plugin directory, and read the web server logs.