Bricksforge Wild RCE Forces Orgs to Patch to 3.1.8.10 Amid Active CVE-2026-85097 Attacks
Patchstack confirms active wild exploitation of CVE-2026-85097 in Bricksforge versions up to 3.1.8.9, requiring immediate updates.
Key points
- CVE-2026-85097 carries a maximum CVSS score of 10.0 and enables unauthenticated remote code execution.
- Patchstack detected active exploitation attempts on October 7, 2026, at 21:47 UTC.
- Version 3.1.8.10 contains the patch for this critical security vulnerability.
The Bricksforge WordPress plugin versions up to and including 3.1.8.9 are affected by a critical security flaw that allows unauthenticated remote code execution. A fix is available in version 3.1.8.10. Managed service providers must verify their client environments immediately to ensure they are not running vulnerable iterations of this popular visual building tool extension.
How it unfolded
- Patchstack detected active exploitation of CVE-2026-85097 on October 7, 2026, at 21:47 UTC.
- Attackers targeted the unauthenticated bricksforge_regenerate_nonce AJAX endpoint to obtain valid nonces for requests.
- Exploitation attempts primarily hit the /wp-json/bricksforge/v1/form_submit endpoint with crafted file uploads.
Who is affected
Bricksforge versions up to 3.1.8.9 are vulnerable to CVE-2026-85097, which has a CVSS score of 10.0. The flaw stems from insufficient validation of the URL field in the temporaryFileUploads parameter during form submission. Attackers upload a GIF/PHP polyglot file that passes initial MIME checks. They then submit a form pointing to that image but ending in a PHP extension. The plugin trusts this metadata and executes the code. Patchstack recorded 63 source IP addresses.
Our take on the response
The rapid detection of wild exploitation by Patchstack highlights the immediate danger of unauthenticated remote code execution flaws in widely used plugins. The specific attack pattern involving polyglot files and nonce abuse demonstrates sophisticated automation. This suggests that simple WAF rules may not suffice if they do not inspect the specific parameter manipulation described in the advisory.
Who needs to act first
Teams should prioritize sites with public-facing forms or high traffic volumes, as these present the largest attack surface for unauthenticated exploits. Before applying the update to live production environments, administrators should test the patch on staging servers to ensure compatibility with custom themes and other plugins. Creating full system backups before the update process is essential to allow for quick restoration if the new version causes unexpected conflicts or downtime for end users.
What to do and how to stay safe: Bricksforge
- Audit all WordPress installations to identify any running Bricksforge versions prior to 3.1.8.10.
- Apply the 3.1.8.10 update immediately to remediate CVE-2026-85097.
- Review server logs for requests to /wp-json/bricksforge/v1/form_submit or admin-ajax.php for signs of compromise.
- Monitor for unusual file uploads or new PHP files in temporary directories.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-85097?
The vulnerability has a maximum CVSS score of 10.0.
Which Bricksforge versions are vulnerable?
Versions up to and including 3.1.8.9 are affected.
Is there a patch available?
Yes, version 3.1.8.10 fixes the vulnerability.
