Unauthenticated File Upload Vulnerability in Bricksforge Plugin for WordPress
CVE-2026-85097

9.8CRITICAL

Key Information:

Vendor: WordPress
Status: Bricksforge
Vendor: CVE Published:; 8 October 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 10,100💰 Ransomware👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-85097?

CVE-2026-85097 is a critical vulnerability in the Bricksforge plugin utilized by WordPress, a popular content management system. This vulnerability specifically pertains to versions up to and including 3.1.8.9, where it allows an unauthenticated attacker to upload arbitrary files to the server. The root cause of this issue is insufficient validation of a user-controlled URL field in the 'temporaryFileUploads' parameter during the submission of forms. By exploiting this vulnerability, attackers can first obtain a valid nonce through a specific AJAX endpoint, allowing them to upload a malicious file disguised as a GIF that contains executable PHP code. Consequently, this capability enables attackers to execute arbitrary PHP scripts on the server, which can lead to severe operational and security implications for affected organizations.

Potential impact of CVE-2026-85097

Unauthorized Code Execution: The most significant risk posed by this vulnerability is the potential for attackers to execute arbitrary code on the server. This can lead to full control of the affected system, allowing malicious actors to manipulate data, deploy malware, or engage in further attacks against the organization.
Data Breaches: Successful exploitation can facilitate unauthorized access to sensitive information stored on the server. This can result in severe data breaches, jeopardizing customer information, proprietary data, and the organization’s overall integrity.
Reputational Damage: The vulnerability can lead to significant reputational harm for organizations, especially if exploited to compromise user data or disrupt services. Public awareness of security breaches can diminish trust among clients and stakeholders, impacting customer retention and business relationships.

Affected Version(s)

Bricksforge 0 <= 3.1.8.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-85097
Created by Masriyan

News Articles

Esecurity Planet

CVE-2026-85097

Bricksforge CVE-2026-85097: Fix Critical RCE Flaw

Bricksforge CVE-2026-85097 is under active attack. See affected WordPress plugin versions, critical risks, patch guidance, and signs of exploitation.

2 weeks ago

Webpronews

CVE-2026-85097

WordPress Sites Face Immediate Threat as Attackers Weaponize Bricksforge Plugin Flaw for Unauthenticated Server Takeover

Attackers exploit CVE-2026-85097 in the Bricksforge WordPress plugin for unauthenticated remote code execution via polyglot file uploads. Active since October 7 with clusters of automated probes observed, the CVSS 10.0 flaw affects thousands of sites. Immediate patching to version 3.1.8.10 or later ...

2 weeks ago