CVSS 10.0 Bricksforge Flaw Under Attack: WordPress Sites Can Be Hijacked Without a Password

A critical flaw in the Bricksforge plugin for WordPress lets attackers run code on a target site without any authentication. The vulnerability is being actively exploited right now.

What Happened?

WordPress security firm Patchstack reports that CVE-2026–85097 is being used in real-world attacks. The flaw carries the maximum CVSS score of 10.0.

Versions up to and including 3.1.8.9 are affected. A fix shipped in version 3.1.8.10. The first exploitation attempt was detected on October 7, 2026, around 21:47 UTC.

Bricksforge extends the Bricks visual site builder with animations, advanced forms, and scroll-based video sequences.

How Does the Attack Work?

A validation gap

The plugin checks a file's type correctly at upload time. When a form is submitted later, though, it simply trusts the file details sent by the client. The "url" field inside the temporaryFileUploads parameter is never validated.

Remote code execution in four steps

1. The attacker requests a valid nonce from an AJAX endpoint that needs no login.
2. They upload a GIF/PHP "polyglot": a file that is a valid image and also contains PHP code. It passes the type check.
3. They submit a form whose file path points to that image, while the "url" ends in a PHP extension.
4. The plugin trusts the submitted data and writes the contents to the PHP location. The code runs when the file is requested.

What Are the Attackers Doing?

Patchstack says attackers target both the Bricksforge REST API form endpoint and admin-ajax.php using the bricksforge_form_submit action. To slip past filters, they try alternate extensions such as .php5 and .phtml, mixed letter case, and encoded extensions.

Telemetry shows activity from 63 unique IP addresses, with six accounting for about 46% of requests. In one cluster, 44 IPs sent 56 identical requests. In another, three IPs tested 25 extension variations.

These patterns suggest automated exploitation. Patchstack does not attribute the activity to a single threat actor.

What's at Stake?

A successful attack can give the intruder control of the site. They can plant web shells, read sensitive data, and establish persistent access.

What Should Site Owners Do?

• Update the plugin immediately. The patch arrived in 3.1.8.10; the report names 4.0.1 as the latest version.
• Review requests to /wp-json/bricksforge/v1/form_submit that include temporaryFileUploads.
• Look for unexpected PHP files in /wp-content/uploads/bricksforge/tmp/.

Other WordPress Threats in the Same Period

Attackers are also abusing XSS flaws in WPC Product Bundles for WooCommerce (CVE-2026–93836) and Ninja Forms (CVE-2026–94504), both rated CVSS 7.1. Their goal is to install a backdoor plugin and create a hidden administrator account.

Important: Updating these plugins stops new attacks but does not remove an existing infection. Owners should check the database for hidden admins.

According to Wordfence, 2,073 WordPress vulnerabilities were published in Q2 2026. High-threat flaws rose 15.2% to 182, and roughly 573,000 sites were compromised.

Source: The Hacker News, Patchstack, Wordfence