CVE-2026-85097

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

No known exploitation. EPSS puts it in the 22nd percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile22nd0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-08Updated 2026-10-08Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

BricksforgeAffected: ≤ 3.1.8.9Upgrade to: after 3.1.8.9Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your WordPress site's plugin list for 'Bricksforge' and note the version number — anything 3.1.8.9 or earlier is affected.
Since no official patch is available yet, deactivate the Bricksforge plugin immediately until a fix is released.
If you cannot deactivate it, ask your host or a security provider to block or monitor requests to the plugin's file upload and nonce-regeneration endpoints.
Check your site for unexpected PHP files in upload directories, which would indicate the site may already be compromised.
Watch for a vendor update and apply it as soon as it becomes available.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Patchstack reported active in-the-wild exploitation of CVE-2026-85097, a critical unauthenticated file upload vulnerability in the Bricksforge WordPress plugin.
as reported · Oct 12, 2026·SecurityWeek summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

In plain language

Written by AI from the record

A critical, unauthenticated flaw lets attackers upload and run malicious code on any WordPress site using the Bricksforge plugin (version 3.1.8.9 or earlier), with no fix available yet — this needs urgent attention if you use this plugin.

Unauthenticated arbitrary file upload (CWE-434) in Bricksforge ≤3.1.8.9's 'temporaryFileUploads' parameter allows a GIF/PHP polyglot bypass of MIME validation, leading to remote PHP code execution without any authentication or user interaction.

If you're affected

Full website takeover
Malware or ransomware deployment
Customer data exposure
Site used to attack visitors
Search engine blacklisting

What is it

Think of this like a mail slot in your front door that's supposed to only accept flat letters, but someone found a way to slip a loaded weapon through it disguised as a letter. Here, a website add-on (Bricksforge) is supposed to only accept harmless image uploads, but attackers can trick it into accepting and running malicious code instead — without even needing a password to your site.

Who is affected

This matters to you if your website runs on WordPress and uses the Bricksforge plugin, version 3.1.8.9 or earlier. No login or special access is needed for an attacker to exploit this, so if your site is reachable on the internet (which most WordPress sites are), you are exposed.

How urgent is it

Attackers are already being reported as actively exploiting this flaw, and it requires no login or user action to trigger, making it an immediate threat to any public-facing site running the affected plugin. With no official patch yet available, the only reliable protection right now is to disable the plugin or restrict access to it until the vendor ships a fix. Treat this as urgent — do not wait for a patch before taking action.

What to do — in detail

Confirm exposure by identifying all WordPress sites running Bricksforge and checking the installed version via the plugin dashboard or by inspecting the plugin's header file for a version string ≤3.1.8.9. There is currently no fixed version available from the vendor, so the recommended interim mitigation is to deactivate the plugin entirely. If deactivation breaks site functionality and is not feasible immediately, implement a web application firewall rule blocking requests to the 'bricksforge_regenerate_nonce' AJAX action and any endpoint handling the 'temporaryFileUploads' parameter, and restrict uploads directories from executing PHP (e.g., via .htaccess or nginx config denying PHP execution in wp-content/uploads). Audit upload directories and the temporary file upload path for unexpected .php files or recently modified files as an indicator of compromise. Monitor the vendor's changelog and security advisories closely for a patched release, and apply it immediately once available. There is no CISA KEV due date for this CVE at this time, but the active exploitation reported in the press attention finding warrants treating remediation as time-critical regardless.

Technical context

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or interaction required, full compromise of confidentiality, integrity and availability. Weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type), exploited via a GIF/PHP polyglot that passes MIME validation then is renamed to a .php extension through the 'temporaryFileUploads' parameter after obtaining a nonce via an exposed AJAX endpoint. Not currently listed in CISA KEV and no public exploit code/PoC is on record, but press attention reporting indicates exploitation is occurring in the wild, which should be weighted above the low EPSS prediction. No vendor patch is currently available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS22nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 22nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 0 days, from the signal feeds we watch.

2026-10-08Publishedweakness classified, att&ck mapped, record updated, record updated, record updated

Affected products

Bricksforgeoss-project
- BricksforgeOn-premWeb & CMS Plugins / cms-core

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable