As cited
Copy frozen at (site build).
vulnerabilities
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
A critical unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin (CVE-2026-85097, CVSS 9.8) allows attackers to upload and execute arbitrary PHP code without authentication, leading to remote code execution. The vulnerability affects versions up to 3.1.8.9 and has been actively exploited in the wild since October 7, 2026, with attackers using GIF/PHP polyglots and manipulated file metadata to bypass validation. A patch is available in version 3.1.8.10, and Patchstack has deployed mitigation rules to protect vulnerable installations.
Why it matters: WordPress site operators running Bricksforge versions up to 3.1.8.9 face immediate risk of unauthorized code execution and should update to 3.1.8.10 or deploy traffic-layer mitigation while patching.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
A critical unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin (CVE-2026-85097, CVSS 9.8) allows attackers to upload and execute arbitrary PHP code without authentication, leading to remote code execution. The vulnerability affects versions up to 3.1.8.9 and has been actively exploited in the wild since October 7, 2026, with attackers using GIF/PHP polyglots and manipulated file metadata to bypass validation. A patch is available in version 3.1.8.10, and Patchstack has deployed mitigation rules to protect vulnerable installations.
Why it matters: WordPress site operators running Bricksforge versions up to 3.1.8.9 face immediate risk of unauthorized code execution and should update to 3.1.8.10 or deploy traffic-layer mitigation while patching.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
A critical unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin (CVE-2026-85097, CVSS 9.8) allows attackers to upload and execute arbitrary PHP code without authentication, leading to remote code execution. The vulnerability affects versions up to 3.1.8.9 and has been actively exploited in the wild since October 7, 2026, with attackers using GIF/PHP polyglots and manipulated file metadata to bypass validation. A patch is available in version 3.1.8.10, and Patchstack has deployed mitigation rules to protect vulnerable installations.
Why it matters: WordPress site operators running Bricksforge versions up to 3.1.8.9 face immediate risk of unauthorized code execution and should update to 3.1.8.10 or deploy traffic-layer mitigation while patching.
- Source published
- First seen by Cybersecurity Tracker