A maximum-severity flaw in the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. Tracked as CVE-2026-85097 (CVSS 10.0), it allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress sites, achieving remote code execution. The flaw affects Bricksforge versions up to and including 3.1.8.9, fixed in 3.1.8.10. Patchstack detected exploitation attempts on 7 October 2026 at 9:47 p.m. UTC. The vulnerability stems from insufficient validation of a URL field in the 'temporaryFileUploads' parameter during form submission: Bricksforge validates a file's MIME type on first upload but trusts client-sent file metadata on a later form submission. Attackers chain the flaw through four steps — obtaining a valid nonce from an unauthenticated AJAX endpoint, uploading a GIF/PHP polyglot that passes the MIME check, submitting a form whose 'file' path points at the validated image while the 'url' ends in a PHP extension, and letting Bricksforge place the payload at the PHP location for execution. Websites running the plugin should upgrade to 3.1.8.10 and check for indicators of compromise.

• Source article