- Patchstack first observed exploitation activity targeting Bricksforge on Oct 7 at 21:47 UTC.
- Bricksforge versions through 3.1.8.9 are affected, while version 3.1.8.10 fixes the flaw.
- Arbitrary PHP execution can let attackers deploy web shells, modify site content, read sensitive data and establish persistent access.
Patchstack said it first observed exploitation activity targeting Bricksforge on Oct 7 at 21:47 UTC, and published its report on Oct 8.
The flaw affects Bricksforge versions through 3.1.8.9. An attacker can use it to execute arbitrary PHP code on a server, deploy web shells, modify site content, read sensitive data and establish persistent access.
Bricksforge is a WordPress plugin, while WordPress is a web content management system used for websites, online stores, forums and other web content. The Hacker News said the vulnerability is tracked as CVE-2026-85097 and has a CVSS score of 10.0.
On this page
Bricksforge trusts client-supplied upload metadata
Bricksforge validates an uploaded file’s MIME type, but later trusts metadata sent by the client when a form is submitted. In particular, it does not validate the URL field inside the temporaryFileUploads parameter.
Patchstack described a path that starts with an attacker requesting a valid nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint and uploading a GIF/PHP polyglot, a file that is both a valid image and contains PHP code.
Patchstack recorded 63 source IPs in exploitation attempts
Most exploitation attempts targeted the Bricksforge REST API form-submission endpoint. One attempt targeted admin-ajax.php.
Patchstack recorded 63 unique source IPs, and the six most active accounted for about 46% of requests.
One cluster involved 44 IPs sending 56 identical requests within seconds. Another used three IPs to test 25 variations of PHP extensions and encodings against the same temporary file.
Patchstack recommends updating Bricksforge to version 3.1.8.10 or later. It said its RapidMitigate rule for CVE-2026-85097 can block the exploitation attempts at the traffic layer if updating is not possible right away.
Patchstack said the observed activity points to automated exploitation over rotating proxies or distributed infrastructure, but does not attribute the activity to one threat actor.
What to do now
- Update Bricksforge to version 3.1.8.10 or later.
FAQ
What happened to the Bricksforge WordPress plugin?
Patchstack said it first observed exploitation activity targeting Bricksforge on Oct 7 and published its report on Oct 8.
Which Bricksforge versions are affected?
Bricksforge versions through and including 3.1.8.9 are affected. Version 3.1.8.10 fixes the vulnerability.
What can the Bricksforge vulnerability do?
It can allow arbitrary PHP execution on the server, enabling attackers to deploy web shells, modify site content, read sensitive data and establish persistent access.
Has the Bricksforge flaw been exploited?
Yes. Patchstack said it was being targeted in the wild and first observed exploitation activity on Oct 7 at 21:47 UTC.
How do I fix CVE-2026-85097 in Bricksforge?
Update Bricksforge to version 3.1.8.10 or later. Patchstack said its RapidMitigate rule can block exploitation attempts at the traffic layer if updating is not possible right away.
Sources
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Patchstack said the Bricksforge vulnerability was being targeted in the wild. | Patchstack | Attributed |
| Patchstack first observed exploitation activity on 7 October 2026 at 21:47 UTC. | Patchstack | Attributed |
| The Hacker News said the Bricksforge vulnerability is CVE-2026-85097 and has a CVSS score of 10.0. | The Hacker News | Attributed |
| The vulnerability affects Bricksforge versions through 3.1.8.9, and version 3.1.8.10 fixes it. | Patchstack | Confirmed |
| Bricksforge fails to validate the URL field in temporaryFileUploads after validating the uploaded file’s MIME type. | Patchstack | Confirmed |
| The resulting arbitrary PHP execution can let attackers deploy web shells, modify site content, read sensitive data, and establish persistent access. | Patchstack | Confirmed |
| Most exploitation attempts targeted the Bricksforge REST API form-submission endpoint, while one hit admin-ajax.php. | Patchstack | Confirmed |
| Patchstack recorded 63 unique source IPs, with the six most active accounting for about 46% of requests. | Patchstack | Confirmed |
| One exploitation cluster involved 44 IPs sending 56 identical requests within seconds, while another tested 25 extension variations from three IPs. | Patchstack | Confirmed |
| Patchstack said the observed patterns indicate automated exploitation but do not attribute the activity to one threat actor. | Patchstack | Attributed |
| Patchstack says its RapidMitigate rule for CVE-2026-85097 can block exploitation attempts if immediate updating is impossible. | Patchstack | Confirmed |
| WordPress is a web content management system used for websites, online stores, forums, and other web content. | Wikipedia | Confirmed |
| patchstack.com published its report on Oct 8, 2026. | patchstack.com | Confirmed |
Could not verify
- Whether attackers successfully compromised any specific Bricksforge sites is not established
- How many sites were affected is not established
- Whether the activity was conducted by one threat actor is not established
Related stories
Vulns & PatchesAhsay Systems’ AhsayCBS flaws exploited to deploy webshells and miners
Vulns & PatchesCisco NX-OS flaws could enable code execution on Nexus switches
Vulns & PatchesScanning and RCE attempts on video-surveillance devices rose in Ukraine