A critical remote code execution flaw in the Bricksforge WordPress plugin (CVE-2026-85097) with a CVSS of 10.0 affects versions up to 3.1.8.9; a patch is available to 3.1.8.10.

The same vulnerability is being exploited in the wild with a CVSS of 9.8, allowing unauthenticated attackers to upload arbitrary files and execute malicious code, potentially giving full control of affected sites.

Patchstack telemetry shows activity from 63 unique source IPs, with two exploitation clusters suggesting automated attempts via rotating proxies or distributed infrastructure.

One cluster comprises 44 IPs delivering 56 identical payload requests in seconds; another cluster includes three IPs testing 25 PHP extension/encoding variations against a single temporary file, signaling automated, diversified probing.

Users should update to Bricksforge 4.0.1, audit form_submit requests, monitor for repeated submissions, and check for unexpected PHP files in the temporary uploads directory.

Exploitation targets the REST API form submission endpoint (/wp-json/bricksforge/v1/form_submit) or admin-ajax.php with bricksforge_form_submit, employing multiple PHP extensions and encodings to bypass filters.

Contextual notes place this within broader WordPress vulnerability trends and recent disclosures for industry awareness.

Defensive guidance emphasizes applying patches, strong firewalling, hardened configurations, comprehensive scanning, and real-time alerts to detect and prevent exploitation.

Bricksforge is a commercial add-on for the Bricks WordPress site builder, used on roughly 6,000 websites to enable features like custom forms and admin tools.

Historical context shows attackers frequently target WordPress vulnerabilities soon after patches are released, including plugin and core flaws.

Wordfence data for Q2 2026 reports 2,073 WordPress vulnerabilities disclosed, with high-threat flaws rising 15.2% and about 573,000 WordPress sites compromised; top vulnerabilities and attacker origins are noted.

The attack workflow involves obtaining a valid nonce via bricksforge_regenerate_nonce, uploading a GIF/PHP polyglot, submitting a crafted temporaryFileUploads payload, and triggering PHP code execution when the file is requested.