Bricksforge (WordPress) Pro Forms unauthenticated arbitrary file upload to PHP execution, exploited since 2026-10-07; fixed in 4.0.1 and 3.1.8.10

CVE-2026-85097, Bricksforge for WordPress: an unauthenticated upload in the Pro Forms module writes attacker PHP into the uploads directory, exploited since 7 October; fixed in 4.0.1 and 3.1.8.10 (CVSS 9.8)

Bricksforge's Pro Forms module checks a file's type when it is first uploaded but trusts the file metadata the client sends when the form is submitted, in particular the url field of the temporaryFileUploads parameter (Patchstack, 2026-10-08). An attacker obtains a nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, uploads a GIF/PHP polyglot that passes the type check, then submits a form whose file path names that image and whose url ends in a PHP extension; the plugin writes the image's content to the PHP path and one request to it executes the code (Patchstack, 2026-10-08). Versions up to and including 3.1.8.9 are affected (Patchstack, 2026-10-08). The vendor's changelog lists the fix in 4.0.1 (Bricksforge, 2026-10-08), while Patchstack names 3.1.8.10 as the fixed build of the 3.x line, which the public changelog does not list (Dr. Web, 2026-10-09). Dr. Web credits Wordfence with a CVSS score of 9.8 and Patchstack with 10.0 (Dr. Web, 2026-10-09).

Patchstack's telemetry first recorded exploitation attempts on 2026-10-07 at 21:47 UTC, from 63 distinct source addresses, and it calls the activity automated without attributing it (Patchstack, 2026-10-08). Patchstack describes exploitation attempts and says an attacker with execution can deploy web shells, modify site content, read data and persist (Patchstack, 2026-10-08). It counts about 6,000 active installations (Dr. Web, 2026-10-09), Previdian tags the flaw "PoC available" (Previdian, 2026-10-08), and the flaw is not in CISA's KEV catalog (Dr. Web, 2026-10-09).