Unauthenticated arbitrary file upload via temporaryFileUploads in Bricksforge WordPress plugin leads to RCE (CVE-2026-85097)
Patchstack published on 2026-10-08 that this flaw is being exploited and VulnCheck added it to its known-exploited catalog on 2026-10-07; sites still on 3.1.8.9 or earlier are exposed to a no-login webshell drop.
Bricksforge, a Bricks Builder add-on for WordPress, lets an unauthenticated attacker fetch a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot to the temporary upload directory, and then submit a form with a crafted 'temporaryFileUploads' parameter to move the file into a web-reachable location. The result is arbitrary PHP execution on the site with no credentials required.
Affected: Bricksforge WordPress plugin <= 3.1.8.9
How to Test
In WordPress Plugins, confirm the installed Bricksforge version; anything at or below 3.1.8.9 is vulnerable. Review web server logs for unauthenticated requests to admin-ajax.php with action bricksforge_regenerate_nonce followed by form submissions carrying a 'temporaryFileUploads' parameter, and inspect the plugin's temporary upload directory and wp-content/uploads for files with GIF headers containing PHP code or unexpected .php files.
How to Patch
Update Bricksforge to the latest release newer than 3.1.8.9 published in the vendor changelog (bricksforge.io/version-changelog/). If you cannot update immediately, deactivate the plugin or block unauthenticated access to the bricksforge_regenerate_nonce AJAX action and the form submission endpoint at the WAF; Patchstack states it has deployed a mitigation rule for its customers.