Bricksforge WordPress plugin flaw lets anyone upload files, now exploited

Bricksforge WordPress plugin flaw lets anyone upload files, now exploited

7 October 2026: Bricksforge, an add-on for the Bricks page builder on WordPress, has an unauthenticated arbitrary file upload flaw tracked as CVE-2026-85097. Patchstack rates it CVSS 10, marks it as known to be exploited and lists 3.1.8.10 as the fixed release. Every version up to and including 3.1.8.9 is affected.

Not yet independently verified. Every report of exploitation traces back to Patchstack, and we found no statement or changelog entry from Bricksforge itself. We will update this when it can be confirmed, and remove this note.

What the flaw allows

The bug sits in the handling of the temporaryFileUploads parameter. A visitor who is not logged in can upload malicious files to the server, and on a typical WordPress host that is enough to run code and take the site over. Patchstack classes it under injection in the OWASP Top 10 and gives the required privilege as none.

Patchstack's database credits the finding to a researcher using the handle d.v4n_s3c and published the entry on 7 October 2026. Patchstack told The Hacker News it first detected attempts to exploit the flaw on 7 October 2026 at 21:47 UTC. Its entry says vulnerabilities of this kind are used in mass-exploitation campaigns, in which attackers scan for the plugin across many sites rather than picking targets one by one.

Which versions to look for

Bricksforge describes itself as a toolkit for Bricks Builder that adds forms, GSAP animations, an email designer, a backend designer and admin pages. Because its features are modular, a site can run the plugin with only one or two of them switched on, but the vulnerable code is part of the plugin itself, so Patchstack lists the whole range up to 3.1.8.9 as affected.

The fixed release is 3.1.8.10. Patchstack's guidance is to update to that version or later, and to ask a host or web developer for help where an update is not possible. It has also issued a mitigation rule that blocks the attack for sites running its protection until the plugin is updated.

Third disclosure in about six weeks

The file upload bug is the newest of seven vulnerabilities in Patchstack's history for the plugin, and the third since early September. A privilege escalation affecting versions up to 3.1.8.8 was disclosed on 2 September 2026, and an unauthenticated arbitrary password reset through Pro Forms, affecting versions before 3.1.8.8, followed on 18 September 2026. Earlier entries date from April 2024 and April 2026.

Anyone who held the plugin at an older release for any length of time has therefore been exposed to more than one problem, and the update to 3.1.8.10 includes the fixes for all of them if Patchstack's version ranges are right.

Signs a site may already have been hit

Because the flaw writes files, the first check is for PHP files or other unexpected uploads in the WordPress uploads folder and in any temporary directory the plugin uses. Administrator accounts nobody created, new scheduled tasks and changed core files are the other usual traces of a web shell. A site that ran a vulnerable version while exposed to the internet should be treated as possibly compromised, not just patched.

Company profile on TrustList: Bricksforge

Related on TrustList:

• WordPress 7.1.3 fixes seven flaws, including SQL injection in export

Sources

• Patchstack: Bricksforge <= 3.1.8.9 unauthenticated arbitrary file upload via temporaryFileUploads parameter, 7 October 2026
• Patchstack: Bricksforge plugin vulnerability history, 13 October 2026
• The Hacker News: Attackers exploit CVSS 10.0 Bricksforge WordPress flaw enabling unauthenticated RCE, 12 October 2026