A critical security vulnerability in the Bricksforge plugin for WordPress is being actively exploited by hackers to take over websites, according to a report from Patchstack. The flaw, designated CVE-2026-85097, carries the maximum possible severity score of 10.0 and allows attackers who aren't logged in to upload and run malicious code on affected sites. Patchstack detected the first exploitation attempts on October 7, 2026, at 9:47 p.m. UTC, targeting websites running Bricksforge versions up to and including 3.1.8.9.
The vulnerability stems from how Bricksforge handles file uploads during form submissions. While the plugin checks a file's type when it's first uploaded, it doesn't verify the URL field inside the 'temporaryFileUploads' parameter when the form is later submitted. Attackers exploit this weakness through a four-step process: they request a valid security token from an unauthenticated endpoint, upload a file that's both a valid image and contains PHP code, submit a form where the file path points to the validated image but the URL ends in a PHP extension, and finally execute the embedded code when that file is requested. Patchstack observed two distinct attack patterns—one cluster involving 44 IP addresses sending 56 identical requests within seconds, and another where three IPs tested 25 variations of PHP extensions and encodings against the same temporary file. The attacks originated from 63 unique source addresses, with six of them responsible for roughly 46% of all requests.
"An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed," Wordfence explained in an advisory. The report notes that successful exploitation allows attackers to seize control of WordPress sites, deploy web shells, read sensitive data, and establish persistent access. Hackers are targeting either the Bricksforge REST API form submission endpoint or the admin-ajax.php endpoint with a crafted 'temporaryFileUploads' parameter, and they're using alternate PHP extensions like .php5 and .php7, case manipulation such as .PHP or .pHp, and encoded extensions like .%70hp to bypass filtering.
The exploitation activity points to automated attacks running through rotating proxies or distributed infrastructure, though the patterns don't definitively link the activity to a single threat actor, according to Patchstack. Site owners are advised to upgrade to version 4.0.1 of the plugin immediately, audit incoming requests to the form submission endpoint that contain a 'temporaryFileUploads' parameter, and look for unexpected PHP files in the plugin's temporary directory. The disclosure comes as attackers are also exploiting cross-site scripting flaws in two other WordPress plugins—WPC Product Bundles for WooCommerce and Ninja Forms—to deliver a JavaScript payload that installs backdoor plugins and creates hidden administrator accounts. While updating the vulnerable plugins prevents further exploitation, it won't remove an existing infection, making it essential for site owners to audit for hidden administrators by querying the database directly, check the must-use plugin directory, and review web server logs. Organizations running vulnerable WordPress configurations face a persistent threat landscape where timely patching alone may not be enough to stay ahead of increasingly sophisticated exploitation campaigns. The shift toward automated, distributed attacks suggests defenders will need layered monitoring and rapid incident response capabilities beyond traditional update cycles.