A WordPress plugin that most people have never heard of is the reason a lot of small-business websites will be rebuilt from backup this month. Bricksforge, an add-on for the Bricks site builder, has an upload flaw that lets a stranger on the internet put PHP on your server and run it. Patchstack says it saw the first exploitation attempt at 9:47 p.m. UTC on 7 October. The Hacker News reported it on 12 October, five days into the attacks.
How the upload check gets fooled
The bug is tracked as CVE-2026-85097 and covers Bricksforge up to and including 3.1.8.9. Per the write-up, the plugin checks a file's MIME type when it arrives, then later believes what the client says about that file. Specifically, it never validates the url field in the temporaryFileUploads parameter. The reported attack runs in four steps: grab a valid nonce from an unauthenticated AJAX action, upload a GIF that is also valid PHP so the type check passes, submit a form that points file at the harmless GIF while url ends in a PHP extension, then request the result. The plugin does the renaming for the attacker.
Observed traffic tries .php5, .phtml, mixed-case and percent-encoded extensions. That is the behaviour of people who know blocklists exist. Patchstack counted 63 source IPs, with six of them making up roughly 46% of requests, and one cluster of 44 addresses sending identical payloads within seconds of each other. It describes the pattern as automated and rotating through proxies, and does not name an actor.
The numbers do not agree, so check yourself
Do not copy a severity or a version from a single article here. The Hacker News gives CVSS 10.0, while a vulnerability listing on TheHackerWire shows 9.8 and describes the same upload flaw as of 3.1.8.9. The Hacker News itself is inconsistent about the fix: a patch note says 3.1.8.10, while the mitigation advice says 4.0.1. We could not find a vendor changelog or an install count to settle it. Read the plugin's changelog and the Patchstack entry directly, and pick the newest release rather than the one in this post. The same Hacker News piece also lists two other WordPress plugin flaws (CVE-2026-93836 in WPC Product Bundles, fixed in 8.6.7, and CVE-2026-94504 in Ninja Forms, fixed in 3.15.4) being chained through cross-site scripting to plant backdoor plugins and hidden administrators.
What to do today
- List every WordPress site you run or host, including the marketing microsites someone launched in 2023. Find out which have Bricksforge. The plugin will not appear in your asset register.
- Update to the newest release. If you cannot update immediately, deactivate the plugin; a deactivated plugin cannot process the form.
- Hunt before you relax. Check
/wp-content/uploads/bricksforge/tmp/for PHP files, and search web logs back to 7 October for requests to/wp-json/bricksforge/v1/form_submitthat carrytemporaryFileUploads. - If you find anything, patching is not enough. Look for hidden administrator accounts and files in the must-use plugins directory, and rotate the database and API credentials that live in
wp-config.php. - Block execution of PHP from upload directories at the web-server level. It would have turned this from a takeover into a nuisance.
The deeper point is about supply. A site builder is a business decision, but every extra plugin is a small piece of software nobody on your side reviewed. If you want a second pair of eyes on a WordPress estate, or on the process that decides what gets installed, write to sales@halfteck.com.