PATCHSTACK has disclosed a critical unauthenticated RCE flaw in the Bricksforge WordPress plugin (CVE-2026-85097, CVSS 10.0) that is actively being exploited in the wild. The vulnerability affects Bricksforge up to version 3.1.8[.]9, with a fix released in 3.1.8[.]10.
The flaw stems from insufficient validation of a URL field within the temporaryFileUploads parameter during form submission, allowing an attacker to upload a GIF/PHP polyglot image that passes MIME checks and then coerce the server into executing embedded PHP code.
Exploitation targets the Bricksforge form submission endpoints, including /wp-json/bricksforge/v1/form_submit and the WordPress admin-ajax[.]php path with bricksforge_form_submit, as attackers submit a crafted temporaryFileUploads payload to trigger remote code execution. Patchstack notes that an unauthenticated attacker can first obtain a valid nonce from the bricksforge_regenerate_nonce endpoint, then exploit the mismatched file and URL data to achieve RCE.
Observed exploitation shows multiple clusters of automated activity across at least 63 unique source IPs, with patterns indicating proxy- or bot-based probing. Patchstack and Wordfence describe two main exploitation clusters, including attempts to vary PHP file extensions and encodings to bypass filters; victims are advised to update to Bricksforge 4.0.1 and audit requests to the vulnerable endpoints for suspicious temporaryFileUploads payloads and unexpected PHP files in the uploads/ttmp directory.
The article also notes related WordPress flaws disclosed contemporaneously: WPC Product Bundles for WooCommerce CVE-2026-93836 and Ninja Forms CVE-2026-94504, both rated 7.1, linked to a JavaScript payload collection used for post-exploitation. Site owners should apply the patches cited and review server logs for anomalous activity targeting these plugins.