Threat Overview

A maximum-severity arbitrary file upload vulnerability in Bricksforge, a popular extension for the Bricks visual site builder for WordPress, is coming under active exploitation in the wild. The flaw (tracked as CVE-2026-85097 with a CVSS 10.0 rating) enables unauthenticated remote attackers to upload polyglot GIF/PHP files and manipulate form submission parameters to execute arbitrary PHP code directly on target web servers.

Threat Metric Technical Details
Severity Rating CRITICAL (CVSS 10.0 / 10.0)
Vulnerability Class Unrestricted Upload of File with Dangerous Type (CWE-434)
Vulnerable Component Bricksforge Plugin (versions up to and including 3.1.8.9)
Attack Vector Unauthenticated HTTP Requests / REST API Form Submissions

The Breakdown: How the Exploit Works

The vulnerability stems from insufficient validation of attacker-controlled URL fields in the temporaryFileUploads parameter during form processing.

When a file is first uploaded, Bricksforge validates its MIME type in temporary storage. An unauthenticated attacker first requests a valid nonce via the publicly accessible bricksforge_regenerate_nonce AJAX endpoint and uploads a valid GIF/PHP polyglot file to temporary storage.

Next, during form submission, Bricksforge processes temporaryFileUploads. However, the server-side code trusts the attacker-supplied url parameter inside the submission payload when determining the final file extension. By specifying a path ending in .php, the attacker tricks the plugin into moving the temporary file to permanent storage with an executable .php extension, permitting immediate remote code execution via direct HTTP requests.

The Operational Risk: What an Attacker Gains

Active exploitation in the wild grants threat actors immediate, unauthenticated server access:

  • Complete Remote Code Execution (RCE): Attackers drop web shell backdoors to execute arbitrary command-line instructions inside the web server process.
  • Persistent Infection & Ransomware: Automated scanners deploy persistent backdoors, dump database credentials, and pivot across adjacent sites on shared hosting environments.

Our Take in Plain English

“Visual site builders trade architectural safety for design convenience. When a form widget on a live web server is given permission to move uploaded files into public directories, a single validation bug opens the front door to automated exploit bots. On a modern pre-rendered edge architecture, interactive forms route through decoupled serverless endpoints into sandboxed storage where execution runtimes do not exist.”

The Modern Architectural Remedy

  • Legacy Dynamic WordPress: Requires an active PHP execution engine and writable upload directories on the live web host, leaving file-upload widgets exposed to bypass attacks.
  • Modern Pre-Rendered Architecture: Serves pre-compiled static assets with zero executable filesystem or PHP runtime on public edge nodes, making remote script execution impossible.

Immediate Action Items for WordPress Operators

  1. Update Bricksforge Immediately: Upgrade all installations to Bricksforge version 3.1.8.10 or higher to close the file-move flaw.
  2. Audit Upload Directories: Inspect upload folders for newly created .php files or unexpected temporary attachments.
  3. Apply WAF Virtual Patching: Enable application firewall rules targeting bricksforge_regenerate_nonce and temporaryFileUploads manipulation.