Bricksforge RCE Exploit Enables Unauthenticated Remote Code Execution

Bricksforge RCE Exploit Enables Unauthenticated Remote Code Execution

A CVSS 10.0 vulnerability (CVE-2026-85097) in the Bricksforge WordPress plugin allows attackers to execute arbitrary PHP code without authentication. The flaw is present in all releases up to 3.1.8.9 and was publicly disclosed on October 12, 2026.

Attack Path

1. Nonce acquisition – An unauthenticated user calls the public AJAX endpoint bricksforge_regenerate_nonce. The endpoint returns a valid nonce that the plugin uses to validate subsequent form submissions.
2. Polyglot upload – The attacker uploads a file that is both a GIF image and a PHP script. The plugin performs MIME type validation based on the file extension and the Content-Type header, both of which can be spoofed. The GIF header satisfies the image check while the PHP payload remains intact.
3. Metadata trust – During form submission, the plugin trusts the url field in the temporaryFileUploads array. The attacker sets this field to the path of the uploaded polyglot and changes the file extension to .php in the form data.
4. Execution – The plugin writes the file to the WordPress uploads directory and then includes it in a PHP context. Because the file ends with a .php extension, the server interprets it as PHP code and executes the attacker’s payload.

Permissions Gained

The exploit grants full remote code execution on the affected WordPress site. An attacker can read, modify, or delete any file, install backdoors, or pivot to other systems on the same network. The attack does not require any user credentials or elevated privileges.

Evidence and Impact

• Date of disclosure: October 12, 2026.
• Affected versions: 3.1.8.9 and earlier.
• Patch version: 3.1.8.10.
• Number of public advisories: 3, including the Patchstack report and the Bricksforge security bulletin.
• Potential impact: Full site takeover, data exfiltration, and persistence.

Mitigation Steps

1. Upgrade – Move to Bricksforge 3.1.8.10 or later. The patch removes the public nonce endpoint and validates file uploads against a strict MIME whitelist.
2. Disable the plugin – If an upgrade is not immediately possible, temporarily deactivate Bricksforge to eliminate the attack surface.
3. Restrict upload directories – Ensure that the WordPress uploads directory is not writable by the web server or that PHP execution is disabled in that directory via .htaccess or server configuration.
4. Monitor logs – Inspect wp-content/uploads for unexpected PHP files and review access logs for anomalous POST requests to bricksforge_regenerate_nonce.

What to Watch Next

• Plugin updates – Bricksforge may release additional security patches; monitor the plugin’s changelog.
• WordPress core – Ensure the core installation is at the latest stable release to mitigate other known vulnerabilities.
• Third-party plugins – Verify that other plugins do not expose similar public AJAX endpoints or rely on client-side metadata for file handling.

Summary

CVE-2026-85097 is a high-severity flaw that enables unauthenticated remote code execution on WordPress sites using the Bricksforge plugin. The attack chain is straightforward: obtain a nonce, upload a polyglot file, submit a form that trusts the file URL, and trigger PHP execution. Immediate upgrade to 3.1.8.10 or temporary deactivation of the plugin is required to mitigate the risk.

Related coverage

• How SMB Cybersecurity Complexity Threatens Advanced Protection Goals
• Microsoft Twitter Account Hijacked for Crypto Scam Featuring Clippy
• Unpatched LMCache Vulnerability Exposes AI Servers to Remote Code Execution

Explore more on this topic

• More wordpress coverage