A Bricksforge WordPress vulnerability is being actively targeted, and owners of affected websites should check their installed plugin version. Tracked as CVE-2026-85097, the flaw can let an unauthenticated attacker upload and execute PHP code on a vulnerable server.
Patchstack observed exploitation attempts from 7 October 2026 and published its analysis on 8 October. Wider reporting followed on 12 October. A fix exists, although installing it cannot undo a compromise that may already have happened.
Bricksforge WordPress vulnerability: affected versions
Bricksforge is a commercial add-on for the Bricks visual builder, offering tools such as Pro Forms, animations and backend customisation. The issue is in Bricksforge, not in every WordPress or Bricks installation.
Patchstack and Wordfence identify versions 3.1.8.9 and earlier as affected. The corrected 3.x release is 3.1.8.10. The developer also records a Pro Forms file-upload security fix in 4.0.1, released on 8 October 2026. If you use the 4.x branch, check for 4.0.1 or a newer vendor-confirmed secure version; do not assume 4.0.0 includes that subsequent fix.
The developer warns that sites with Pro Forms active may be affected even if their forms have no file-upload field. Removing an upload field is therefore not a reliable workaround.
How the unauthenticated file upload flaw works
Bricksforge checks a file’s type during its initial upload. Later, when a form is submitted, the plugin can trust client-supplied file metadata without validating it sufficiently. The discrepancy can allow executable PHP to be written to a location where the server runs it.
This unauthenticated file upload weakness can lead to remote code execution (RCE). Successful exploitation could allow an intruder to alter pages, read information accessible to the web application, or maintain a web shell. The exact consequences depend on server permissions and configuration. An affected version is a serious exposure, but not proof that a particular website has been breached.
Patchstack recorded attempted exploitation from 63 distinct source IP addresses. Its analysis suggests automated, distributed traffic, without identifying one responsible threat actor. The number of IP addresses should not be mistaken for the number of compromised sites.
Why vulnerability scores differ
Some coverage lists CVE-2026-85097 at 10.0; other sources use 9.8. Patchstack publishes 10.0, while the Wordfence-linked record and SecurityWeek report show 9.8 under CVSS v3.1. Both treat the vulnerability as critical.
There is no need to conceal that difference. For patch prioritisation, the combination of unauthenticated code execution, observed attacks and an available fix is more useful than debating the last decimal place.
Why it matters for small businesses
Many business websites rely on forms to receive enquiries, bookings and customer details. Owners may not realise those forms are processed by a separate commercial extension. An attacker who gains code execution could threaten the site and data available to its application account.
Agencies face a wider inventory problem: the same plugin may appear across several client sites. Identify installations and versions before sending warnings. There is no evidence that all WordPress sites are vulnerable to this Bricksforge-specific issue.
What to do about CVE-2026-85097
Update the plugin and verify the result
Check the WordPress plugins screen or your managed-hosting inventory. Take a restorable backup, then update promptly to a corrected release: 3.1.8.10 or later for the 3.x line, or 4.0.1 or later for 4.x, following current vendor guidance. Confirm the installed version afterwards and test business-critical forms.
A WordPress core security update does not automatically patch an independent commercial plugin. Both need their own maintenance checks.
Look for signs of earlier exploitation
If an affected version was exposed, review web-server and application logs for unusual Bricksforge form submissions. Look for unexpected PHP files in upload directories, newly created administrator accounts and unexplained changes to site files. Patchstack publishes defensive indicators to guide a more targeted review.
Preserve suspicious files and relevant logs before cleaning the site if compromise is suspected. Updating closes the known vulnerability but may leave behind an intruder’s code or access.
Handle temporary mitigations carefully
Patchstack says it deployed a traffic-layer mitigation rule. That can help protected installations, but does not establish that every hosting firewall blocks all attack variations. If updating is temporarily impossible, involve the hosting provider, reduce exposure and arrange the patch as soon as possible.
Trade-offs and incident-response limits
An urgent plugin update can affect custom forms or integrations. A tested backup and focused post-update checks reduce that risk; postponing indefinitely is difficult to justify when attackers are already probing the flaw.
If compromise is plausible, treat the situation as an incident, not simply routine maintenance. Preserve evidence, investigate unwanted code and accounts, restore from a verified clean state where necessary, and rotate relevant credentials after containing the intrusion. Public threat statistics cannot certify that an individual site is clean.
Critical analysis
The compelling evidence here is the sequence. Patchstack observed attacks from 7 October; the vendor’s changelog confirms an upload-related fix on 8 October; independent reporting on 12 October brought the finding to a wider audience. This is more actionable than an advisory with no observed exploitation.
There are important limits. Patchstack’s telemetry covers what its systems could observe and cannot establish the total number of attacks or successful compromises. Its technical analysis is more detailed than the vendor’s brief release note. Owners should use both: the researcher for the threat pattern and the developer for the corrected version.
For a small WordPress estate, the lasting improvement is operational rather than cosmetic. Keep a current plugin inventory, know where updates come from, and retain backups and logs that make investigation possible. Those controls help when the next vulnerability appears, too.
Sources
- Patchstack – Bricksforge unauthenticated file-upload vulnerability, 8 October 2026.
- Bricksforge – Official version changelog, 8 October 2026.
- Wordfence Intelligence – Bricksforge vulnerability record, checked 13 October 2026.
- SecurityWeek – Bricksforge vulnerability exploited in the wild, 12 October 2026.
Leave a Reply