Severity: Critical | Priority: 1
Attackers are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in Bricksforge, a WordPress plugin that adds forms, animations and other features to the Bricks website builder. An attacker who hasn’t logged in can upload PHP code to a vulnerable site and run it, which gives them full control of the website. All versions up to and including 3.1.8.9 are affected. WordPress security company Patchstack first saw exploitation on October 7, 2026.
The plugin checks that an uploaded file is an image when it is first uploaded, but when the form is submitted, it trusts the file details sent by the visitor’s browser. Attackers upload a file that is both a valid image and a PHP program, then submit a form telling the plugin to save it with a PHP extension. When they open that file in a browser, the web server runs their code. To get past filtering, they rotate through alternative and disguised PHP file extensions. The attacks are automated and come from many different IP addresses, many of them rotating proxies.
Once their code runs, attackers can install web shells for permanent access, create administrator accounts, read the site’s database and configuration (including database passwords), deface the site or use it to spread malware.
On GajIPS alert:
/wp-content/uploads/bricksforge/tmp/ and anywhere else under /wp-content/uploads/, which should only hold media files.wp-config.php, and any hosting or FTP credentials.