Bricksforge - Arbitrary File Upload (CVE-2026-85097)
Description
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
psychologyCrowdSec Analysis
CVE-2026-85097 is a critical unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin, affecting versions up to and including 3.1.8.9. Attackers can exploit insufficient validation in form submissions to upload and execute arbitrary PHP code, potentially compromising the server and exposing or altering data.
CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-85097 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target WordPress sites by requesting /wp-admin/admin-ajax.php with the bricksforge_regenerate_nonce action, then sending a GIF/PHP polyglot to /wp-json/bricksforge/v1/form_file_upload and submitting it through /wp-json/bricksforge/v1/form_submit. The uploaded PHP file is then accessed under /wp-content/uploads/ to trigger code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-10-08 |
| Rule Released | 2026-10-23 |