A Perfect-10 WordPress Plugin Flaw Is Under Attack: The Bricksforge Spec Sheet and a Site Owner’s Checklist
Attackers are exploiting a maximum-severity flaw in the Bricksforge add-on for WordPress that lets anyone with no login run code on a site. Here are the key facts on one page, plus what to check today.
If your company website was built with the Bricks visual builder for WordPress, check today whether it also runs the Bricksforge add-on. A flaw in that plugin rated 10.0 out of 10 lets an outsider with no account run their own code on the web server, and attackers have been doing exactly that since last week.
The details below come from Ravie Lakshmanan’s coverage at The Hacker News, which draws on research from WordPress security firms Patchstack and Wordfence.
Spec sheet
- Vulnerability: CVE-2026-85097
- Severity: CVSS 10.0, the maximum
- Product: Bricksforge, an add-on for the Bricks site builder that adds animations, advanced forms and scroll-driven video sequences
- Vulnerable versions: 3.1.8.9 and earlier
- Fix: first patched in 3.1.8.10. The current recommendation is to move to the latest release, 4.0.1
- Login needed to exploit: none
- Impact: attackers can upload and run arbitrary PHP code, which is enough to take over the site, plant web shells, read sensitive data and stay in place
- Exploitation first seen: October 7, 2026 at 9:47 p.m. UTC, according to Patchstack
- Attribution: none. The traffic looks automated and spread across many addresses, but researchers have not tied it to a single group
Why the check fails
Bricksforge inspects a file properly when it is first uploaded, but when a form is submitted later it believes whatever file details the visitor’s browser sends back. That gap makes the attack a four-move sequence:
- Ask an unauthenticated AJAX endpoint (bricksforge_regenerate_nonce) for a valid security token.
- Upload a “polyglot” file that is a genuine GIF image and also contains PHP code. It passes the file-type check and lands in a temporary folder.
- Submit a form whose file path points to that approved image, while the separate ‘url’ value inside the temporaryFileUploads parameter ends in a PHP extension.
- The plugin copies the file’s contents to that PHP location. Requesting the file runs the attacker’s code.
What the attack traffic looks like
- Requests hit the Bricksforge form endpoint at /wp-json/bricksforge/v1/form_submit, or /wp-admin/admin-ajax.php with the bricksforge_form_submit action, carrying a crafted temporaryFileUploads parameter.
- The declared file is a GIF or PNG, while the destination URL points to a PHP payload.
- To dodge extension filters, attackers rotate alternate extensions (.php5, .php7, .phtml), mixed capitalization (.PHP, .Php) and URL-encoded versions of “.php”.
- Patchstack saw one burst of 56 identical requests from 44 IP addresses within seconds, and a second cluster of three IPs trying 25 extension and encoding variations against the same file.
- In total, activity came from 63 unique IP addresses, and six of them sent roughly 46% of the requests.
Two more plugins in the same warning
The same report notes separate attacks on cross-site scripting flaws in WPC Product Bundles for WooCommerce (CVE-2026-93836) and Ninja Forms (CVE-2026-94504), both rated 7.1. There, a JavaScript payload runs in a logged-in administrator’s browser, installs a malicious plugin, creates an administrator account hidden from the Users screen and sets up a “magic” login link that signs the holder in as the site’s oldest administrator. Versions 8.6.7 and 3.15.4 block new attacks, but updating does not remove an infection that is already there.
For scale, Wordfence counted 2,073 newly published WordPress vulnerabilities in the second quarter of 2026, with high-threat flaws up 15.2% from the prior quarter to 182, and about 573,000 WordPress sites compromised in that period.
Site owner checklist
- ☐ Confirm whether Bricksforge is installed, including on sites a designer or agency built for you.
- ☐ Update Bricksforge to the latest release (4.0.1), or at minimum 3.1.8.10. If you can’t update right away, disable the plugin until you can.
- ☐ Review web logs for requests to /wp-json/bricksforge/v1/form_submit that include temporaryFileUploads, and for bursts of repeated form submissions.
- ☐ Look for unexpected PHP files in /wp-content/uploads/bricksforge/tmp/.
- ☐ If you run WPC Product Bundles or Ninja Forms, update them, then check the database directly for hidden administrator accounts, review the must-use plugins folder and read your server logs.
- ☐ If you find signs of compromise, treat it as an incident: restore from a known-good backup, then change administrator, hosting and database passwords.
What this means for your company
For many small and mid-size businesses, the website is the most exposed system they own and the least watched. Add-on plugins are often installed once by a designer and then forgotten, so a critical bug can stay open for weeks after a fix ships. The practical answer is ownership: someone needs to know every plugin on every site you run, apply updates on a schedule, keep tested backups somewhere the website can’t reach, and put a web application firewall in front of anything that takes form submissions or uploads.
Need help auditing your WordPress plugins, or cleaning up after a suspected site compromise? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
