A critical vulnerability in the Bricksforge plugin for the Bricks Builder page builder is being actively exploited in the wild. If your site runs Bricksforge, this is not a “patch when you get a chance” bug — attackers are already scanning for it.
What CVE-2026-85097 actually does
Bricksforge versions up to and including 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability. According to Patchstack’s advisory, an attacker with no login credentials at all can upload a file through an AJAX endpoint that doesn’t properly validate what it’s receiving. One researcher described attackers obtaining a valid nonce from an unauthenticated AJAX endpoint, then using it to upload a GIF/PHP polyglot file — a file crafted to pass as an image while containing executable PHP code.
Once that file lands on the server, it can be executed directly, handing the attacker remote code execution on your site with zero authentication required. That’s the worst category of WordPress vulnerability: no login, no social engineering, no plugin misconfiguration needed beyond having the plugin installed and active.
Severity and exploitation status
Scoring differs slightly between researchers — Patchstack and The Hacker News report a CVSS score of 10.0, while Strix lists it at 9.8. Either way, this sits at the top of the severity scale. Patchstack’s telemetry shows exploitation attempts beginning October 7, 2026 at 21:47:17 UTC, roughly a day after public disclosure on October 8. That’s a very short window between “vulnerability disclosed” and “attackers actively using it” — a pattern that’s become common for critical WordPress plugin flaws in 2026.
The fix
Bricksforge 3.1.8.10 patches the vulnerability. If you’re running Bricksforge 3.1.8.9 or earlier, update immediately — not at your next maintenance window.
What to check if you run Bricksforge
- Update first. Confirm you’re on 3.1.8.10 or later before doing anything else.
- Check for unexpected administrator accounts. A successful exploit often creates a new admin user as a persistence mechanism.
- Scan the uploads directory for PHP files. Legitimate uploads shouldn’t include executable PHP. Any .php file sitting in wp-content/uploads is a red flag.
- Review recent file modification times on theme and plugin files for anything that doesn’t match your own deployment history.
- If you find signs of compromise, updating the plugin alone will not clean an already-compromised site — you’ll need a full malware scan and likely a credential reset.
The broader pattern
This is at least the second unauthenticated file-upload vulnerability disclosed in a widely used WordPress plugin this month. File upload handlers remain one of the most common ways attackers get code execution on WordPress sites, because they sit at the intersection of user input and the filesystem — exactly where validation gaps turn into remote code execution. If you maintain any site using Bricks Builder with Bricksforge installed, treat this as a same-day update, not a scheduled one.