Bricksforge gets an unauthenticated RCE under active attack
CVE-2026-85097 lets an attacker upload a PHP file with no login at all. Patchstack says exploitation began within a day of disclosure.
Bricksforge, a paid add-on for the Bricks Builder WordPress theme, has a critical unauthenticated file upload bug that’s already being exploited. CVE-2026-85097 carries a CVSS score of 10.0, and Patchstack says its telemetry shows attacks beginning on 7 October at 21:47 UTC, within a day of the flaw becoming known.
The bug is in Bricksforge’s temporary file upload handling: an attacker can fetch a valid nonce from an AJAX endpoint with no credentials, then submit a GIF/PHP polyglot file that passes MIME validation and gets written to a path they control, giving them arbitrary PHP execution on the server. Patchstack recorded 63 unique source IPs running the attack, including one cluster of 44 IPs that sent identical payloads within seconds of each other. Versions up to and including 3.1.8.9 are affected; 3.1.8.10 fixes it.
Why it matters: this needs no authentication at all, which is the worst combination a WordPress file-upload bug can have, and the attacks started fast enough that “I’ll patch it this week” isn’t a safe plan. If you or a client runs Bricks Builder with Bricksforge installed, update now rather than waiting for a maintenance window.
The caveat: neither Patchstack nor Bricksforge has published an install count, so there’s no number for how many sites are exposed.