Attackers exploit unauthenticated Bricksforge WordPress plugin flaw allowing arbitrary PHP upload and remote code execution

Patchstack detected active exploitation of CVE-2026-85097, a flaw rated 10.0 in the Bricksforge WordPress plugin, beginning October 7. The plugin does not validate the url field inside its temporaryFileUploads parameter, letting an unauthenticated attacker upload and execute arbitrary PHP code on vulnerable sites. Exploitation came from 63 unique source IPs, with six responsible for roughly 46 percent of requests. Versions up to and including 3.1.8.9 are affected; the vendor released a fix in 3.1.8.10, and the current release is 4.0.1. Wordfence published an advisory. Site operators should update immediately and check for unexpected PHP files and administrative changes.

Check

Update the Bricksforge plugin to at least 3.1.8.10, ideally 4.0.1, on all WordPress sites, then check for unexpected PHP files and new administrator accounts.

Affected

WordPress sites running Bricksforge up to 3.1.8.9 let an unauthenticated attacker upload and execute arbitrary PHP code, and exploitation has been underway since October 7.

Fix

Upgrade Bricksforge immediately, scan for web shells and unauthorized files, remove rogue admin accounts, rotate credentials and keys, and restrict access to the WordPress admin interface.