# CVE-2026-85097: Bricksforge - Arbitrary File Upload

> Live exploitation tracking for CVE-2026-85097 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-85097

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Bricksforge
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** wordpress, cms

## Description

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

## CrowdSec analysis

[CVE-2026-85097](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-85097) is a critical unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin, affecting versions up to and including 3.1.8.9. Attackers can exploit insufficient validation in form submissions to upload and execute arbitrary PHP code, potentially compromising the server and exposing or altering data.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-85097 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target WordPress sites by requesting `/wp-admin/admin-ajax.php` with the `bricksforge_regenerate_nonce` action, then sending a GIF/PHP polyglot to `/wp-json/bricksforge/v1/form_file_upload` and submitting it through `/wp-json/bricksforge/v1/form_submit`. The uploaded PHP file is then accessed under `/wp-content/uploads/` to trigger code execution.

## Timeline

- 2026-10-08: CVE Published. CVE-2026-85097 is published to NVD.
- 2026-10-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-85097 exploitation attempts against the CrowdSec Network.

## References

- https://bricksforge.io/version-changelog/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85097.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-85097) follows observed exploitation activity for CVE-2026-85097. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.