Global Cybersecurity Alert: Website administrators utilizing the WordPress ecosystem are facing an urgent security crisis. Hackers are currently and actively exploiting a maximum-severity remote code execution (RCE) vulnerability in Bricksforge, a popular and powerful third-party companion plugin for the Bricks visual builder.

Tracked as CVE-2026-85097, this critical flaw has been assigned a 10.0 CVSS score—the highest possible rating on the Common Vulnerability Scoring System. The vulnerability allows unauthenticated remote attackers to bypass security layers, upload malicious payloads, and execute arbitrary PHP code directly on underlying servers without needing any prior user credentials or administrative privileges.

Security researchers and automated threat intelligence platforms have confirmed that attacks began mere hours after the flaw was discovered, leaving hundreds of thousands of WordPress websites potentially exposed to total system takeover.

1. Main Facts: Anatomy of the CVE-2026-85097 Flaw

To understand the sheer magnitude of CVE-2026-85097, one must examine how Bricksforge operates within a WordPress environment. Bricksforge is a paid, premium "Swiss Army knife" plugin designed to extend the capabilities of the Bricks Builder visual interface. It introduces advanced animations, complex dynamic forms, scroll-driven video sequences, and extended design features.

The catastrophic vulnerability originates specifically within the plugin’s form-handling module, which manages user file uploads.

How the Attack Vector Operates

According to comprehensive technical analyses published by Patchstack and The Hacker News, the vulnerability stems from a severe validation oversight in input handling:

1. Flawed MIME Validation: The Bricksforge plugin correctly checks the MIME type of an uploaded file during the initial upload phase. However, it completely fails to validate the URL field of the temporaryFileUploads parameter when the form is subsequently submitted.
2. Acquiring a Valid Nonce: Attackers exploit an unauthenticated AJAX endpoint to securely generate and harvest a valid nonce token, neutralizing standard WordPress security checks.
3. The Polyglot Bypass: Threat actors upload a specially crafted "polyglot" file—a file structured to masquerade simultaneously as a harmless GIF image and executable PHP code. Because the file passes the initial MIME type check, the system accepts it.
4. Malicious Relocation and Execution: The attacker then submits the form while specifying a target destination URL ending in a PHP extension. The plugin blindly writes the file contents to that specified directory. Once written, any HTTP request sent directly to that path forces the server to execute the embedded PHP script, giving the attacker a persistent backdoor.

All versions of Bricksforge up to and including 3.1.8.9 are affected.

2. Chronology of the Attack Campaign

The timeline surrounding the discovery, weaponization, and active exploitation of CVE-2026-85097 highlights the lightning-fast speed at which modern cybercriminal networks operationalize zero-day or newly disclosed vulnerabilities.

• October 7, 2026 – 21:47 UTC: Security platform Patchstack records the very first anomalous requests targeting the Bricksforge upload endpoint.
• Immediate Post-Detection Hours: Automated scanning scripts sweep the internet, probing thousands of WordPress endpoints to locate installations running vulnerable builds of the plugin.
• Days Following Discovery: Threat intelligence indicates a coordinated, highly automated campaign utilizing advanced evasion techniques. Patchstack tracks connection attempts originating from at least 63 distinct IP addresses.
• Concentrated Traffic Patterns: Analysis reveals that just six IP addresses are responsible for roughly 46% of the total malicious traffic. Notably, one organized threat actor utilized 44 distinct proxy IP addresses to launch 56 identical attack requests within seconds. Another group tested 25 distinct variations of file extensions and string encodings—including .phtml, mixed-case naming conventions, and obfuscated extensions—specifically designed to bypass basic Web Application Firewall (WAF) signature rules.

Security researchers attribute the campaign to automated botnets leveraging rotating proxies, pointing to a widespread, opportunistic sweep rather than a targeted spear-phishing campaign against a specific organization.

3. Supporting Data & Broader Ecosystem Risks

The Bricksforge incident does not occur in a vacuum; it arrives amid a worsening trend of supply-chain vulnerabilities within the WordPress plugin repository.

Broader Campaign Activity

Simultaneously, security analysts have flagged parallel exploitation campaigns targeting other major WordPress components:

• WPC Product Bundles for WooCommerce: Affected by a Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-93836 (patched in version 8.6.7).
• Ninja Forms: Affected by an XSS flaw tracked as CVE-2026-94504 (patched in version 3.15.4).

In both cases, attackers have exploited these flaws to inject persistent backdoors and silently spawn hidden, high-privilege administrator accounts.

Statistical Context from Wordfence

Data published by Wordfence for the second quarter of 2026 paints a grim picture of the overall security landscape:

• A staggering 2,073 vulnerabilities were officially cataloged within the WordPress ecosystem during Q2 2026.
• High-severity vulnerabilities surged by 15.2% compared to the previous quarter, totaling 182 critical flaws.
• Approximately 573,000 individual WordPress websites suffered compromises or breaches due to plugin and theme vulnerabilities during this period.

This trend underscores a systemic reliance on third-party code that often lacks rigorous security auditing before deployment. Recent high-profile incidents involving major tools—such as an emergency patch cycle for Elementor and WordPress core pushing out version 7.1.3 to remediate seven concurrent vulnerabilities (three of which were discovered by AI safety firm Anthropic)—prove that no platform component is immune.

4. Official Responses and Mitigation Procedures

Maintainers of Bricksforge responded swiftly to the disclosure, releasing security patches designed to close the file validation loophole. However, security experts emphasize that simply pressing the "update" button is only half the battle.

Immediate Action Required for Administrators

1. Update the Plugin Immediately: All webmasters running Bricksforge must update the plugin immediately. While Patchstack recommends upgrading to version 3.1.8.10 or later, The Hacker News and core security auditors advise updating directly to the absolute latest version available (4.0.1 or higher) to ensure complete protection against evolving exploit variants.
2. Understand the Limitation of Patching: Applying an update stops future incoming attacks by blocking the file-upload vector. However, updates do not clean a server that has already been compromised. If a site was exposed prior to patching, it must be treated as potentially breached.

How to Audit Your Website for Compromise

Site administrators who ran a vulnerable version of Bricksforge without advanced runtime application self-protection (RASP) or strict firewall rules should execute a thorough forensic audit:

• Inspect Upload Directories: Check /wp-content/uploads/bricksforge/tmp/ and other standard or custom WordPress upload directories for suspicious, recently created PHP files or obfuscated scripts.
• Review Server Access Logs: Search historical server logs for HTTP POST requests directed to /wp-json/bricksforge/v1/form_submit containing suspicious temporaryFileUploads parameters.
• Audit User Accounts: Inspect the WordPress dashboard for unauthorized or unrecognized administrator accounts. Malicious actors frequently create hidden shadow accounts to maintain persistence even if plugins are later updated.
• Scan Core and Plugin Files: Utilize file integrity monitoring tools or security plugins (such as Wordfence, MalCare, or Sucuri) to scan the entire filesystem for unauthorized modifications, modified core files, or hidden backdoor scripts placed in the mu-plugins (must-use plugins) folder.

5. Implications for the WordPress Community

The CVE-2026-85097 incident serves as a stark reminder of the fragile nature of web application security, particularly within open-source content management systems driven by extensible third-party plugins.

When a plugin granting deep functional integration—such as a visual page builder companion—contains an unauthenticated remote code execution vulnerability, the blast radius encompasses the entire hosting infrastructure. An attacker who gains arbitrary PHP execution via WordPress can pivot to the underlying operating system, compromise other databases hosted on the same server, deploy cryptominers, or enlist the compromised server into a global DDoS botnet.

As automated attack tools become more sophisticated, leveraging AI-driven fuzzing and rapid zero-day weaponization, the window between vulnerability disclosure and mandatory system patching has shrunk to mere minutes. Website owners, agencies, and enterprise hosting providers must move away from reactive security models and embrace proactive measures: automated dependency patching, strict file-system permissions, immutable infrastructure design, and continuous real-time traffic monitoring.

Frequently Asked Questions (FAQ)

Which versions of Bricksforge are affected by CVE-2026-85097?

All versions of Bricksforge up to and including 3.1.8.9 are vulnerable. The issue has been patched in version 3.1.8.10 and all subsequent releases (with recommendation to upgrade to 4.0.1 or higher).

Do attackers need user credentials to exploit this vulnerability?

No. CVE-2026-85097 is an unauthenticated vulnerability. Attackers do not need to register an account, log in, or hold any special privileges to trigger the file upload and execute arbitrary code. This accounts for its maximum 10.0 CVSS severity score.

How can I verify if my website has already been targeted or breached?

Review your server error and access logs for requests targeting /wp-json/bricksforge/v1/form_submit. Check your /wp-content/uploads/ directories for unusual PHP files, and thoroughly audit your WordPress users list to ensure no unauthorized administrator accounts have been silently provisioned.

Is updating the Bricksforge plugin sufficient to clean an infected site?

No. While updating blocks the vulnerability vector against subsequent attacks, it does nothing to remove malicious backdoors, scripts, or administrator accounts that may have already been installed prior to the patch. If your site was exposed, a comprehensive manual or automated forensic cleanup is mandatory.