Critical CVE-2026-85097 vulnerability in Bricksforge for WordPress actively exploited
A vulnerability in the Bricksforge plugin allows unauthenticated attackers to upload a file and execute PHP code on the server. Patchstack has recorded exploitation attempts and recommends updating immediately.
CVE-2026-85097 Bricksforge is a critical vulnerability in a WordPress plugin, with attempts at active exploitation already recorded. Patchstack said it observed the activity starting on October 7, 2026, at 21:47:17 UTC. The flaw could allow an unauthenticated attacker to upload an arbitrary file and subsequently execute PHP code on the server.
Bricksforge installations version 3.1.8.9 and earlier are affected if they use the impacted Pro Forms functionality. Patchstack recommends updating to at least version 3.1.8.10. On October 8, the vendor also released Bricksforge 4.0.1, whose changelog lists a security fix for file uploads in Pro Forms.
CVE-2026-85097 Bricksforge: the problem is file uploads
The attack mechanism is related to insufficient validation of the url field in the temporaryFileUploads parameter when a form is submitted. According to the available description, an attacker does not need a WordPress account or access to the administration area.
If successfully exploited, the attacker could place a malicious PHP file on the server and execute it. Possible consequences include taking over the website, deploying a web shell, or stealing data. Administrators should therefore check whether Bricksforge is installed and whether the website uses Pro Forms with file uploads.
Critical rating, different scores
The NVD lists a CVSS 3.1 score of 9.8 for the vulnerability, provided by the CNA Wordfence. Patchstack rates it with a CVSS score of 10.0. Both ratings classify the flaw as a critical security issue; the difference in score does not change the need to deploy the available fix.
Patchstack confirmed observed exploitation attempts, but not the total number of successfully compromised websites. It therefore has not been independently confirmed how many sites attackers actually breached.
What administrators should do
- Check the Bricksforge plugin version on all managed WordPress websites.
- Update to at least Bricksforge 3.1.8.10, or to version 4.0.1 with the vendor-listed Pro Forms file upload fix.
- Check the website and server for unexpected uploaded PHP files or other signs of compromise if the plugin was active in an affected version.
Further developments will show whether the U.S. agency CISA adds CVE-2026-85097 to its Known Exploited Vulnerabilities catalog. Any reports of confirmed compromises and detection indicators from Patchstack or the vendor will also be important.
Sources
- Patchstack – Patchstack confirms observed active exploitation attempts and describes the attack technique, affected versions, and fix 3.1.8.10.
- Bricksforge changelog – The vendor lists a security fix for file uploads in Pro Forms in version 4.0.1, released on October 8, 2026.
- NVD – The CVE record confirms the affected version range, flaw type, and the CNA Wordfence CVSS score of 9.8.
- SecurityWeek – Independently reports on the vulnerability being exploited in practice.
Verified and updated: October 13, 2026, 06:28
