Bricksforge: Unauthenticated arbitrary file upload in Pro Forms
Summary
The Bricksforge plugin for WordPress allows unauthenticated users to upload files through its form upload handling, because the attacker-controlled url field of the 'temporaryFileUploads' parameter is insufficiently validated. A GIF/PHP polyglot can pass the MIME check and be renamed to a .php file, which allows an attacker to run arbitrary PHP code on the server without logging in. Patchstack reports active exploitation, with attempts first observed on October 7, 2026, mostly against the Bricksforge REST form submission endpoint.
Affected
- Bricksforge 3.1.8.9 and earlier (all versions up to and including 3.1.8.9)
- Affected component: Pro Forms file upload
Fixed in
- Fixed in 3.1.8.10 and 4.0.0 according to the vendor changelog
- Latest version in the vendor changelog: 4.0.2 (13 October 2026), which also contains further security hardening of the REST endpoints
Workaround
- Update is the preferred fix; no workaround is needed where patching is possible
- If patching must be delayed, use a WAF or security plugin rule that blocks this attack; Patchstack has deployed a mitigation rule
- Consider disabling the Pro Forms component until the update is applied, if forms with file upload are not essential
Exploitation
- Exploited in the wild: yes, according to Patchstack and other reports
- No public proof of concept found in the reviewed sources; assume working exploit code is available
- CISA KEV status: not verified
- CISA SSVC: exploitation none, automatable yes, technical impact total
Our recommendation
- Update Bricksforge to 4.0.2 or at least 3.1.8.10 / 4.0.0 immediately, and check the vendor changelog for the latest version
- Check whether the site is running Bricksforge 3.1.8.9 or earlier; this check is urgent
- Audit requests to /wp-json/bricksforge/v1/form_submit that contain a temporaryFileUploads parameter and look for repeated form submissions
- Check /wp-content/uploads/bricksforge/tmp/ for unexpected PHP files and remove them after updating, because an update does not remove files already placed
- Check for unknown WordPress administrator accounts (also hidden ones) and unexpected magic login URLs; treat any finding as a compromise and reset credentials
- Rotate API keys stored in Bricksforge settings as a precaution, as recommended by the vendor
- Monitor the plugin changelog, as Patchstack reports repeated serious vulnerabilities in this plugin
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (5 repositories)
Wayang1337/CVE-2026-85097 · tc4dy/CVE-2026-85097-Toolkit · Masriyan/CVE-2026-85097 · RootMantap/CVE-2026-85097 · BlackHatExploitation/CVE-2026-85097
Research sources
- Bricksforge version changelog bricksforge.io
- Wordfence threat intelligence entry www.wordfence.com
- Patchstack: critical unauthenticated arbitrary file upload exploited in Bricksforge patchstack.com
- SecurityWeek: Bricksforge vulnerability exploited in the wild www.securityweek.com
- The Hacker News: attackers exploit Bricksforge thehackernews.com
- SOCRadar: Bricksforge CVE-2026-85097 exploited RCE socradar.io
- eSecurityPlanet: Bricksforge CVE-2026-85097 WordPress RCE www.esecurityplanet.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:34.
Original description (NVD)
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.