Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin

Security firm Patchstack has detected active in-the-wild attacks exploiting a critical unauthenticated file upload vulnerability in the Bricksforge plugin for WordPress, a popular extension for Bricks Builder. Tracked as CVE-2026-85097 with a maximum CVSS score of 10.0, the flaw lets attackers bypass MIME-type checks using image/PHP polyglot files and manipulate the temporaryFileUploads parameter's url field to drop and execute arbitrary PHP code on the server, achieving full remote code execution. The bug affects all Bricksforge versions up to and including 3.1.8.9, and is fixed in version 3.1.8.10. Patchstack first observed exploitation attempts on October 7, 2026 at 21:47 UTC, mostly hitting the plugin's REST API form-submission endpoint, with attackers probing numerous extension and encoding tricks from dozens of distributed IP addresses; site owners are urged to update immediately or apply a virtual-patching rule while they do.