Bricksforge Vulnerability Exploited: Check and Clean Your Site

Attackers have been hitting the Bricksforge vulnerability, CVE-2026-85097, since October 7, 2026. Patchstack saw the first attempt at 21:47 UTC that day, and published its advisory the next day, October 8. The Hacker News reported the exploitation on October 12.

If you run Bricksforge 3.1.8.9 or older on a Bricks site, update to 3.1.8.10 or later now. Then check the site, because updating doesn't remove a file that's already been dropped.

What happened

Bricksforge is an addon for the Bricks visual builder. Its forms accept file uploads, and the bug sits in how they're finished. The plugin checks the MIME type of a file when it's first uploaded. When the form is submitted later, it trusts the file details the browser sends back, including a url field it never validates.

That lets an unauthenticated visitor upload a harmless-looking GIF that also contains PHP, then tell the plugin to publish it under a .php name. Request the file, and the server runs it. Patchstack scores it CVSS 10.0. Our vulnerability database, which mirrors the Wordfence feed, records 9.8. Either way it's critical, and no login is needed.

Key finding

Bricksforge 3.1.8.9 and older let an unauthenticated visitor run PHP on your server. Version 3.1.8.10 fixes it, and attacks started before the advisory did.

Who is exposed

Any site running Bricksforge up to and including 3.1.8.9. We have no install count for Bricksforge to quote, and we won't guess one. What we can say is that the attack needs nothing from you: no account, no logged-in admin, no clicked link.

The vulnerable code is Bricksforge's Pro Forms. Patchstack's write-up doesn't say whether sites without a form that uses file upload are safe, so don't assume it. Update either way.

One practical snag: updates for a licensed plugin often depend on an active licence. If yours lapsed, the dashboard may never show 3.1.8.10. Our guide on why an expired premium licence hides security updates covers how to check and what to do. The update has to be installed by hand if the automatic route is blocked.

How to check a Bricks site for compromise

Patchstack tracked 63 unique source IPs. The six busiest made about 46% of the requests, so blocking a few addresses wouldn't have helped. Work through these checks in order.

1. Look for PHP where PHP shouldn't be. Images and temporary uploads have no reason to contain PHP files. Search the uploads tree:

find wp-content/uploads -type f \( -iname "*.php*" -o -iname "*.phtml" -o -iname "*.pht" -o -iname "*.phps" \)
ls -la wp-content/uploads/bricksforge/tmp/

Patchstack saw attackers aiming at /wp-content/uploads/bricksforge/tmp/, and some payloads used filenames like login_admin_*.php in the normal dated uploads folders such as /wp-content/uploads/2026/10/. Any hit is suspect until you've read it.

2. Search your access logs. Look for POST requests to /wp-json/bricksforge/v1/form_submit that carry a temporaryFileUploads parameter, or calls to /wp-admin/admin-ajax.php with the bricksforge_form_submit action. Also look for calls to bricksforge_regenerate_nonce. The telltale detail is a path ending in .gif or .png paired with a URL ending in a PHP-style extension. Attackers also tried .php5, .phtml, odd capitalisation and URL-encoded extensions, so search for those too.

Then look for GET requests to any PHP file in an uploads folder. A 200 response there means somebody ran it.

3. Check users and recent changes. List administrators with wp user list --role=administrator and look for accounts you didn't create. Then find files changed since October 7:

find . -type f -name "*.php" -newermt "2026-10-07" -not -path "./wp-content/cache/*"

Expect plugin and theme update noise. Look for files you can't explain, especially in wp-content/mu-plugins/, wp-config.php and the theme folders. Our list of signs your WordPress site is hacked covers the symptoms that show up on the front end.

Why blocking the extension isn't enough

A rule that rejects .php uploads would have missed much of this. Patchstack saw the extension varied four ways: .php5, .phtml and .pht in place of .php, mixed case such as .pHp, URL-encoded forms such as %2ephp and .%2570%2568%2570, and edited metadata fields. In one cluster, three IPs tried 25 variations of extension and encoding against the same temporary file.

That's why the log search above should be broad. Don't search for one string and stop when it comes back empty. A request that returns 403 or 404 is an attempt that failed. A request that returns 200 for a file inside uploads is the one to worry about, and it means the code ran.

It also explains why a web application firewall or host rule is only a stopgap. The weak point is the plugin trusting what the browser sent, and the real fix is the vendor's patch.

Clean up if you find something

Don't just delete the file you found. A web shell is usually there to let the attacker back in later, and one found file often means more.

1. Take a full backup first, files and database, and keep it offline. You'll want it as evidence and as a reference.
2. Update Bricksforge to 3.1.8.10 or later so the door is shut before you start cleaning.
3. Remove the PHP files from uploads, then compare WordPress core, plugins and themes against clean copies. wp core verify-checksums handles core. Reinstall plugins and themes from fresh downloads rather than trusting what's on disk.
4. Delete unknown administrator accounts, and reset passwords for everyone who is real.
5. Rotate the database password and the salts in wp-config.php, and any API keys stored on the site.
6. Search for persistence: extra cron entries, odd mu-plugins, modified .htaccess. Our guides on PHP backdoors in WordPress and the full malware removal process walk through where they hide.
7. Re-scan, then watch the logs for a week.

If you can't update straight away, Patchstack says its RapidMitigate rule for this CVE blocks the attacks at the traffic layer. That's a stopgap, not a fix.

Let us check it

A surface scan is free and will tell you whether your Bricksforge version is on our vulnerability list. The $1 deep scan goes inside the server over SSH. It looks at files, users, cron jobs and the database, which is where the persistence from an attack like this lives. If it finds something, our $49 cleanup removes it, and the first cleanup is free for new users.

For the rest of this week's critical updates, see the plugins to patch this week.

References

• Patchstack: Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
• The Hacker News: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw
• Wordfence Intelligence: Bricksforge 3.1.8.9 Unauthenticated Arbitrary File Upload via temporaryFileUploads Parameter
• CVE-2026-85097 in the WP Vanguard vulnerability database