Ethical Hacking News
A critical unauthenticated Remote Code Execution (RCE) flaw has been identified in the Bricksforge WordPress plugin, allowing attackers to execute arbitrary PHP code on vulnerable websites, resulting in RCE. The vulnerability impacts Bricksforge versions up to and including 3.1.8.9 and has been rated as 10.0 on the Common Vulnerability Scoring System (CVSS). The flaw allows unauthenticated attackers to exploit a mismatch where the specified "file" argument is a GIF (or a PNG) file, while the actual URL points to a PHP payload. Users are advised to update to the latest version of the plugin (4.0.1) to mitigate the threat.
A critical RCE flaw has been identified in the Bricksforge WordPress plugin, with a CVSS rating of 10.0. The vulnerability allows unauthenticated attackers to upload and execute arbitrary PHP code, resulting in RCE. The flaw is attributed to insufficient validation of a URL field in the 'temporaryFileUploads' parameter. SSuccessful exploitation could result in arbitrary PHP execution on the server, allowing attackers to seize control of the WordPress site. Threat actors have been targeting the Bricksforge REST API form submission endpoint and /wp-admin/admin-ajax.php with crafted temporaryFileUploads parameters. Users are advised to update to the latest version of the plugin to mitigate the threat, and site owners should audit incoming requests to prevent exploitation.
The cybersecurity landscape continues to be a battleground for attackers seeking to exploit vulnerabilities in various software plugins and plugins, with the latest target being the Bricksforge WordPress plugin. According to the latest intelligence gathered by Patchstack, a security company that specializes in identifying and addressing vulnerabilities in WordPress plugins, a critical unauthenticated Remote Code Execution (RCE) flaw has been identified in the Bricksforge plugin, which is widely used as a "Swiss Army knife" for Bricks, a visual website-building tool for WordPress, with support for animations, advanced forms, and scrolling video sequences.
The vulnerability, identified as CVE-2026-85097, has been rated as 10.0 on the Common Vulnerability Scoring System (CVSS), which indicates a maximum-severity vulnerability. The flaw allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in RCE. The security flaw impacts Bricksforge versions up to and including 3.1.8.9. Patches have been released in version 3.1.8.10.
The vulnerability is attributed to insufficient validation of a URL field in the 'temporaryFileUploads' parameter during form submission. An attacker could exploit this loophole to achieve RCE through four steps: Request a valid nonce from the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint, Upload a GIF/PHP polyglot: a file that is a valid image but also contains PHP code. It passes the MIME check and lands in the temporary upload directory, Submit a form where the 'file' path points to that validated image, but the 'url' ends in a PHP extension, and Bricksforge implicitly trusts the submitted metadata and places the file's contents at the PHP location, leading to the execution of the embedded code when that file is requested.
Successful exploitation of the flaw could result in arbitrary PHP execution on the server, which an attacker can leverage to seize control of the WordPress site, deploy web shells, read sensitive data, and establish persistent access. In the attacks observed by Patchstack, threat actors have been observed targeting the Bricksforge REST API form submission endpoint ("/wp-json/bricksforge/v1/form_submit") or the "/wp-admin/admin-ajax.php" endpoint with "bricksforge_form_submit" action along with a crafted "temporaryFileUploads" parameter.
A representative request is as follows - { "temporaryFileUploads": [ { "field": "form-field-file", "file": { "file": "/var/www/example.com/wp-content/uploads/bricksforge/tmp/img_example.gif", "url": "https://example.com/wp-content/uploads/bricksforge/tmp/img_example.php", "type": "image/gif" } } ] } }. As specified by Wordfence, threat actors are exploiting a mismatch where the specified "file" argument is a GIF (or a PNG) file, while the actual URL points to a PHP payload.
The attacks also exploit alternate PHP extensions (e.g., .php5, .php7, or .phtml), case manipulation (e.g., .PHP, .Php, or .pHp), and encoded extensions (e.g., .%70hp, %2ephp, or .%2570%2568%2570). Two clusters of attacks stand out in the telemetry, with 44 IPs sending 56 requests with identical payloads within seconds of each other, and three IPs testing 25 variations of PHP extensions and encodings against the same temporary file.
The activity has been recorded from 63 unique source IPs, with six of them accounting for roughly 46% of all requests - 177.75.57[.]20, 23.97.62[.]146, 84.247.60[.]125, 38.154.185[.]97, 150.109.16[.]166, and 153.75.90[.]146. Users are advised to update to the latest version of the plugin (4.0.1) to mitigate the threat. Site owners are recommended to audit incoming requests to the "/wp-json/bricksforge/v1/form_submit" endpoint that contain a "temporaryFileUploads" parameter, as well as repeated form submissions and unexpected PHP files in "/wp-content/uploads/bricksforge/tmp/."
This vulnerability highlights the importance of keeping plugins and their dependencies up to date and conducting regular security audits to prevent exploitation. As the threat landscape continues to evolve, it is essential for site owners to remain vigilant and proactive in addressing potential vulnerabilities to prevent data breaches and other forms of cyberattacks.
Related Information:
https://www.ethicalhackingnews.com/articles/WordPress-Bricksforge-Plugin-Flaw-A-Critical-Unauthenticated-RCE-Vulnerability-Exploited-in-the-Wild-ehn.shtml
https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
Published: Mon Oct 12 05:19:01 2026 by llama3.2 3B Q4_K_M
