Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

Patchstack reports active in-the-wild exploitation of a maximum-severity flaw in the Bricksforge plugin for WordPress, tracked as CVE-2026-85097 (CVSS 10.0). The bug lets unauthenticated attackers abuse the 'temporaryFileUploads' parameter — bypassing MIME checks with a GIF/PHP polyglot file and mismatched file paths — to upload and run arbitrary PHP code, giving them full remote code execution on affected sites. All Bricksforge versions through 3.1.8.9 are vulnerable; the vendor shipped fixes in 3.1.8.10, with 4.0.1 recommended as the current safe release. Patchstack first spotted attack traffic on October 7, 2026, from dozens of rotating IPs testing various PHP extension-evasion tricks, and separately, attackers are also exploiting XSS bugs in WPC Product Bundles for WooCommerce (CVE-2026-93836) and Ninja Forms (CVE-2026-94504) to plant hidden admin accounts and backdoors on WordPress sites.