Attackers exploit Bricksforge flaw to breach WordPress websites

Hackers are taking advantage of a critical vulnerability in the Bricksforge WordPress plugin to infiltrate websites without needing to log in. The flaw, CVE-2026-85097, impacts versions 3.1.8.9 and below of Bricksforge. Security firm Patchstack advises website owners to upgrade to version 3.1.8.10 or later, assigning the flaw a maximum severity score of 10.0.

The CVE record classifies it as critical, indicating a high risk of remote code execution. This could allow intruders to take control of compromised sites. The vulnerable plugin's Pro Forms upload feature was patched in version 4.0.1 on October 8th. The attack began on October 7th, with Patchstack observing exploitation attempts from 63 unique IP addresses, some exhibiting coordinated activity.

The weakness occurs when Bricksforge processes files submitted via its form functionality, trusting browser-supplied file information after initially checking file types. Attackers can exploit this by uploading a GIF image that also contains PHP code. Upon form submission, manipulated metadata can trick the system into saving the file with a PHP extension instead of its original image format.

Successful exploitation may allow attackers to install malicious web shells, access sensitive data, modify website content, or maintain unauthorized access. The vulnerability affects every website using Pro Forms, even those without file-upload fields. Patchstack identified the first exploitation attempts on October 7th at 21:47 UTC, with requests originating from 63 distinct IP addresses.

The attackers employed various techniques to evade detection, including testing multiple file extensions and encoding variations. Administrators should update promptly, monitor access logs, and inspect their sites for unauthorized changes.