Bricksforge CVE-2026-85097 exploited: WordPress RCE, update now

If your WordPress site runs Bricks Builder with the Bricksforge add-on, stop and check the version. Bricksforge CVE-2026-85097 lets an anonymous visitor upload a file and run it as PHP on your server. No login. No user click. Attackers started using it on October 7, before most owners heard the plugin had a problem. The fix exists. Updating is step one. Checking whether someone got in first is step two.

What actually happened

Patchstack disclosed the flaw on October 8 and rated it CVSS 10.0. The facts:

• Affected: Bricksforge 3.1.8.9 and earlier. Fixed in 3.1.8.10.
• First exploit attempt in Patchstack telemetry: October 7, 2026, 21:47 UTC.
• The chain: the attacker pulls a valid nonce from an unauthenticated AJAX action (bricksforge_regenerate_nonce), uploads a GIF/PHP polyglot that passes the image check, then submits a form that tells the plugin to write that file to a .php path. The plugin checks the file on upload but trusts the destination URL the client sends at submit time.
• Scale: Patchstack logged 63 unique source IPs, including one cluster of 44 IPs firing identical payloads within seconds. That is automated scanning, not a targeted campaign. Your site does not need to be interesting to get hit.

INCIBE-CERT's entry confirms the affected range. It is also not this plugin's first bad month: CVE-2026-18030, published in August, let an unauthenticated attacker set any user's password, admins included, on versions before 3.1.8.8.

Why it matters for your business

Page-builder add-ons are the soft underbelly of small-business WordPress. Someone installs one for a contact form or a dynamic pricing table, the site ships, and nobody owns the plugin list after launch. That is exactly the gap automated exploit kits hunt.

Update first, then investigate. If 3.1.8.9 or older ran on a public site after October 7, assume it was probed. Patchstack lists what to look for:

• PHP files in /wp-content/uploads/bricksforge/tmp/
• Files named login_admin_*.php, including inside /wp-content/uploads/YYYY/MM/
• POST requests to /wp-json/bricksforge/v1/form_submit with a temporaryFileUploads parameter that pairs an image path with a PHP-type extension

PHP has no business in your uploads folder. Block execution there at the web server level and this whole class of bug loses its teeth. If you find a web shell, a plugin update will not remove it. Rotate admin passwords, database credentials, and API keys stored in wp-config.php, then rebuild from a known-good backup. We covered the cleanup order in our wp2shell post.

A critical flaw and a high-severity account takeover in one plugin in about two months is a signal. Ask whether you still need it.

Sources: Patchstack, INCIBE-CERT CVE-2026-85097, INCIBE-CERT CVE-2026-18030.