{"id":3483,"date":"2026-10-12T09:54:55","date_gmt":"2026-10-12T09:54:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3483"},"modified":"2026-10-12T09:54:55","modified_gmt":"2026-10-12T09:54:55","slug":"attackers-exploit-cvss-10-0-bricksforge-wordpress-flaw-enabling-unauthenticated-rce","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3483","title":{"rendered":"Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhrKeT1xQm0N8zjNRqWwsoqMm3kESRMqYnUJ9Wy6x9dEKlRVgZYDVqKqhu_2ZT7ZcCNd_RegNu2LtnUUQgL8R2OlK5LTyu9vKaCBRGTVrp05hGdB5wQrxFNi_eHnGxx-8yFR7maKT3tD_WBMVVBSeTyuku392tKdoOHIgvnj1tKQYU_Yq9anT5OKxUun4GW\/s1700-nu-rw-lo-l85-e365\/wp-php.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.<\/p>\n<p>The critical vulnerability in question is <strong>CVE-2026-85097<\/strong> (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The security flaw impacts Bricksforge versions up to and including 3.1.8.9. Patches have been <a href=\"https:\/\/bricksforge.io\/version-changelog\/\" target=\"_blank\">released<\/a> in version 3.1.8.10.<\/p>\n<p>Bricksforge is a WordPress plugin that&#8217;s advertised as a \u00abSwiss Army knife\u00bb for Bricks, a visual website-building tool for WordPress, with support for animations, advanced forms, and scrolling video sequences.<\/p>\n<p>WordPress security company Patchstack said it detected exploitation efforts targeting the flaw on October 7, 2026, at 9:47 p.m. UTC.<\/p>\n<p>\u00abBricksforge validates a file&#8217;s MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends,\u00bb Patchstack <a href=\"https:\/\/patchstack.com\/articles\/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin\/\" target=\"_blank\">said<\/a>. \u00abIn particular, it does not validate the &#8216;url&#8217; field inside the &#8216;temporaryFileUploads&#8217; parameter.\u00bb<\/p>\n<p>At a high level, the vulnerability stems from insufficient validation of a URL field in the &#8216;temporaryFileUploads&#8217; parameter during form submission. An attacker could exploit this loophole to achieve RCE through four steps &#8211;<\/p>\n<ul>\n<li>Request a valid nonce from the unauthenticated &#8216;bricksforge_regenerate_nonce&#8217; AJAX endpoint.<\/li>\n<li>Upload a GIF\/PHP polyglot: a file that is a valid image but also contains PHP code. It passes the MIME check and lands in the temporary upload directory.<\/li>\n<li>Submit a form where the &#8216;file&#8217; path points to that validated image, but the &#8216;url&#8217; ends in a PHP extension.<\/li>\n<li>Bricksforge implicitly trusts the submitted metadata and places the file&#8217;s contents at the PHP location, leading to the execution of the embedded code when that file is requested.<\/li>\n<\/ul>\n<p>\u00abAn unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF\/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed,\u00bb Wordfence <a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/bricksforge\/bricksforge-3189-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter\" target=\"_blank\">said<\/a> in an advisory for the flaw.<\/p>\n<p>\u00abSubsequently, the attacker can submit a form with a crafted &#8216;temporaryFileUploads&#8217; parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/growth-ai-control-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVYuoalvwUlwvLZFDideJ8jW4rz-IodX0Lwi7uyP7Ab0wiDeu_BqVhPDdejQQ65MC3p9Xc4MApnHz56NJ5SDc1HMg0DvozkkGYv9TGtDLCh26v1yD5-GyzQxnA5-6A6B4beW96H_6FyrByq22cvU5JDF-i8e5GIfV4wg1SpCvjwAJt74FaqkAb2gzqE7ll\/s728-nu-rw-lo-l85-e365\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Successful exploitation of the flaw could result in arbitrary PHP execution on the server, which an attacker can leverage to seize control of the WordPress site, deploy web shells, read sensitive data, and establish persistent access. <\/p>\n<p><a name=\"more\"\/><\/p>\n<p>In the attacks observed by Patchstack, threat actors have been observed targeting the Bricksforge REST API form submission endpoint (\u00ab\/wp-json\/bricksforge\/v1\/form_submit\u00bb) or the \u00ab\/wp-admin\/admin-ajax.php\u00bb endpoint with \u00abbricksforge_form_submit\u00bb action along with a crafted \u00abtemporaryFileUploads\u00bb parameter.<\/p>\n<p>A representative request is as follows &#8211;<\/p>\n<pre><code>{\n  \"temporaryFileUploads\": [\n    {\n      \"field\": \"form-field-file\",\n      \"file\": {\n        \"file\": \"\/var\/www\/example.com\/wp-content\/uploads\/bricksforge\/tmp\/img_example.gif\",\n        \"url\": \"https:\/\/example.com\/wp-content\/uploads\/bricksforge\/tmp\/img_example.php\",\n        \"type\": \"image\/gif\"\n      }\n    }\n  ]\n}<\/code><\/pre>\n<p>As specified by Wordfence, threat actors are exploiting a mismatch where the specified \u00abfile\u00bb argument is a GIF (or a PNG) file, while the actual URL points to a PHP payload.<\/p>\n<p>To get around extension filtering, the exploitation activity makes use of alternate PHP extensions (e.g., .php5, .php7, or .phtml), case manipulation (e.g., .PHP, .Php, or .pHp), and encoded extensions (e.g., .%70hp, %2ephp, or .%2570%2568%2570).<\/p>\n<p>\u00abTwo clusters stand out in our telemetry. In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other,\u00bb Patchstack said. \u00abIn the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.\u00bb<\/p>\n<p>\u00abBoth patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.\u00bb<\/p>\n<p>The activity has been recorded from 63 unique source IPs, with six of them accounting for roughly 46% of all requests &#8211;<\/p>\n<ul>\n<li>177.75.57[.]20<\/li>\n<li>23.97.62[.]146<\/li>\n<li>84.247.60[.]125<\/li>\n<li>38.154.185[.]97<\/li>\n<li>150.109.16[.]166<\/li>\n<li>153.75.90[.]146<\/li>\n<\/ul>\n<p>Users are advised to update to the latest version of the plugin (4.0.1) to mitigate the threat. Site owners are recommended to audit incoming requests to the \u00ab\/wp-json\/bricksforge\/v1\/form_submit\u00bb endpoint that contain a \u00abtemporaryFileUploads\u00bb parameter, as well as repeated form submissions and unexpected PHP files in \u00ab\/wp-content\/uploads\/bricksforge\/tmp\/.\u00bb<\/p>\n<h3>WPC Product Bundles for WooCommerce and Ninja Forms Flaws Exploited<\/h3>\n<p>The disclosure comes as threat actors are also abusing cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, WPC Product Bundles for WooCommerce (<strong>CVE-2026-93836<\/strong>, CVSS score: 7.1) and Ninja Forms (<strong>CVE-2026-94504<\/strong>, CVSS score: 7.1), to deliver a JavaScript payload (\u00abx.js\u00bb) capable of deploying a backdoor plugin and creating rogue admin accounts.<\/p>\n<p>The plugin features an unauthenticated file manager accessible through a direct request to the plugin&#8217;s main PHP file. It also creates a WordPress administrator hidden from the Users screen and installs a magic login URL, which authenticates the holder as the site&#8217;s oldest administrator.<\/p>\n<p>\u00abIt is a WordPress post-exploitation and persistence implant designed to execute inside the browser of a logged-in administrator,\u00bb Patchstack <a href=\"https:\/\/patchstack.com\/articles\/four-ways-back-in-the-wordpress-xss-campaign-that-hides-its-own-admin-account\/\" target=\"_blank\">said<\/a>. \u00abOnce triggered, it abuses the victim&#8217;s authenticated wp-admin session to install a malicious WordPress plugin, create a new administrator account, invoke an additional hidden persistence mechanism, and report the results to attacker-controlled infrastructure.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>It&#8217;s worth emphasizing that while updating the vulnerable plugins (version 8.6.7 for WPC Product Bundles for WooCommerce and version 3.15.4 for Ninja Forms) prevents further exploitation, it does not remove an existing infection. It&#8217;s essential that site owners audit for hidden administrators by directly querying the database, check the must-use plugin directory, and review web server logs.<\/p>\n<h3>WordPress Exploitation Trends in Q2 2026<\/h3>\n<p>According to data from Wordfence, a total of 2,073 WordPress-related vulnerabilities were published in the second quarter of 2026, with the number of high-threat flaws jumping 15.2% from the previous quarter to 182. About 573,000 WordPress sites were compromised during the time period.<\/p>\n<p>The top five vulnerabilities targeted by attackers are listed below &#8211;<\/p>\n<ul>\n<li><strong>CVE-2024-28000<\/strong> (CVSS score: 9.8) &#8211; LiteSpeed Cache &lt;= 6.3.0.1 &#8211; Unauthenticated Privilege Escalation<\/li>\n<li><strong>CVE-2019-9879<\/strong> (CVSS score: 9.8) &#8211; WPGraphQL &lt;= 0.2.3 &#8211; Administrative User Creation<\/li>\n<li><strong>CVE-2016-15042<\/strong> (CVSS score: 9.8) &#8211; Frontend File Manager &lt; 4.0 &amp; N-Media Post Front-end Form &lt; 1.1 &amp; &#8211; Arbitrary File Upload<\/li>\n<li><strong>CVE-2023-28121<\/strong> (CVSS score: 9.8) &#8211; WooCommerce Payments 4.8.0 &#8211; 5.6.1 Authentication Bypass and Privilege Escalation<\/li>\n<li><strong>CVE-2025-3102<\/strong> (CVSS score: 8.1) &#8211; SureTriggers &lt;= 1.0.78 &#8211; Unauthenticated Administrative User Creation<\/li>\n<\/ul>\n<p>The vast majority of the attacking IP addresses originated from the U.S., followed by Germany, Czechia, Australia, Norway, France, Ukraine, the Netherlands, Switzerland, and Brazil.<\/p>\n<p>\u00abA strong firewall, timely vulnerability patches, and hardened configurations help block malicious traffic before it ever reaches your site,\u00bb Wordfence <a href=\"https:\/\/www.wordfence.com\/blog\/2026\/09\/quarterly-wordpress-threat-intelligence-report-q2-2026\/\" target=\"_blank\">said<\/a>. \u00abComprehensive scanning helps identify vulnerabilities, malware, or suspicious changes on your site that could signal an attempted compromise. Real-time alerts about critical events, login attempts, and file changes help you stay ahead of threats.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score:&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3484,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,3742,497,524,120,70,316,725,1927],"class_list":["post-3483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-bricksforge","tag-cvss","tag-enabling","tag-exploit","tag-flaw","tag-rce","tag-unauthenticated","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3483"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3484"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}