Published on October 13, 2026
WordPress Plugin Vulnerability Exploited in Attacks to Upload and execute Arbitrary PHP code
Severity
Critical
Detail
Security researchers have reported active exploitation of a critical vulnerability affecting the Bricksforge plugin for WordPress. The vulnerability, tracked as CVE-2026-85097, allows an unauthenticated attacker to upload and execute arbitrary PHP code on vulnerable websites, resulting in remote code execution (RCE).
According to Patchstack, exploitation activity targeting the vulnerability was first observed on 7 October 2026. The vulnerability is caused by insufficient validation of the temporaryFileUploads parameter during form submission. Specifically, the plugin fails to properly validate an attacker-controlled URL field, allowing malicious files that pass initial validation checks to be written and executed as PHP code on the server.
Successful exploitation could allow attackers to gain complete control of affected WordPress sites, deploy web shells, access sensitive information, modify website content, and establish persistent access to compromised servers. Researchers observed automated exploitation attempts originating from numerous IP addresses, indicating active scanning and attack activity targeting vulnerable installations.
| CVE ID | Summary | CVSS Score |
| CVE-2026-85097 | An unauthenticated arbitrary file upload vulnerability in the Bricksforge plugin could allow remote attackers to upload and execute arbitrary PHP code, resulting in remote code execution. | 9.8 (Critical) |
Affected Products
The vulnerability affects Bricksforge plugin versions 3.1.8.9 and earlier. The issue has been fixed in version 3.1.8.10.
Recommendation
Organizations should implement the following measures immediately:
- Upgrade Bricksforge to version 3.1.8.10 or later.
- Review web server logs for requests targeting:
- /wp-json/bricksforge/v1/form_submit
- /wp-admin/admin-ajax.php with the bricksforge_form_submit action.
- Inspect the /wp-content/uploads/bricksforge/tmp/ directory for unexpected PHP files, web shells, or suspicious uploads.
- Conduct compromise assessments on vulnerable systems, particularly those exposed to the internet, as active exploitation has already been observed.
- Monitor for unauthorized administrator accounts, suspicious file modifications, and other indicators of post-compromise activity.
Source
https://cybersecuritynews.com/wordpress-plugin-vulnerability-exploited/