---
schema: 1
kind: vulnerability
title: "CVE-2026-85097, Bricksforge for WordPress: an unauthenticated upload in the Pro Forms module writes attacker PHP into the uploads directory, exploited since 7 October; fixed in 4.0.1 and 3.1.8.10 (CVSS 9.8)"
headline: "Bricksforge's Pro Forms upload flaw is exploited without login since 7 October; fixed in 4.0.1 and 3.1.8.10"
summary: >
  Patchstack reports that CVE-2026-85097, an unauthenticated arbitrary file upload in the Pro Forms module of Bricksforge, a
  paid WordPress add-on for the Bricks page builder, has been targeted in the wild since 2026-10-07: it lets an attacker with
  no account get a PHP file written to the uploads directory and executed, on versions up to and including 3.1.8.9 with Pro
  Forms active (about 6,000 active installations). Bricksforge's changelog of 2026-10-08 lists the fix in 4.0.1 and Patchstack
  names 3.1.8.10 for the 3.x line; the exploitation report rests on Patchstack's telemetry.
discovered_at: "2026-10-12T03:21:00Z"
updated_at: null
event_date: "2026-10-07"
run_id: 2026-10-12T0256Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, actively-exploited, poc-public, patch-available]
regions: [global]
sectors: [technology]
entities: ["product:bricksforge"]
techniques: [T1190, T1505.003, T1036.008]
affected_products: ["Bricksforge"]
cves:
  - id: CVE-2026-85097
    cvss: "9.8"
    epss: "0.0031"
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [exploited, poc-public, patch-available]
    affected: "Bricksforge versions up to and including 3.1.8.9"
    fixed: "release 4.0.1 (vendor changelog); build 3.1.8.10 on the 3.x line (Patchstack)"
sources:
  - url: "https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/"
    publisher: "Patchstack"
    date: "2026-10-08"
    role: primary
  - url: "https://bricksforge.io/version-changelog/"
    publisher: "Bricksforge (vendor changelog)"
    date: "2026-10-08"
    role: corroborating
  - url: "https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/"
    publisher: "Dr. Web"
    date: "2026-10-09"
    role: corroborating
  - url: "https://previdian.com/CVE-2026-85097"
    publisher: "Previdian"
    date: "2026-10-08"
    role: corroborating
closed_sources: []
evidence:
  - quote: "This vulnerability is currently being targeted in the wild."
    publisher: "Patchstack"
    source_url: "https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/"
  - quote: "It affects every site with Pro Forms active, including sites whose forms use no upload fields, so updating is strongly recommended."
    publisher: "Bricksforge (vendor changelog)"
    source_url: "https://bricksforge.io/version-changelog/"
  - quote: "Patchstack has observed automated attacks from 63 different IP addresses since 7 October. (translated from German)"
    original: "Patchstack beobachtet seit dem 7. Oktober automatisierte Angriffe von 63 verschiedenen IP-Adressen."
    publisher: "Dr. Web"
    source_url: "https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/"
  - quote: "If the licence has lapsed, the fix may not arrive at all. (translated from German)"
    original: "Bei ausgelaufener Lizenz kommt die Korrektur womöglich gar nicht an."
    publisher: "Dr. Web"
    source_url: "https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/"
  - quote: "Previdian records an exploitation-related signal (poc available)."
    publisher: "Previdian"
    source_url: "https://previdian.com/CVE-2026-85097"
verification: single-source
sourcing_note: "Among the cited sources, Patchstack is the only observer of the exploitation, from its own telemetry, and Dr. Web restates it; Previdian's record adds a proof-of-concept tag, not an independent report of exploitation. The vendor's changelog confirms an upload fix in 4.0.1 without naming the CVE or exploitation, and does not list build 3.1.8.10."
confidence: medium
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Find every WordPress site that your organisation, its web agencies or its hosting suppliers run with Bricksforge and update it to version 4.0.1 (3.1.8.10 on the 3.x line) now, treating any site that was reachable and unpatched since 2026-10-07 as one to search for dropped PHP files."
updates: []
migrated_from: null
---

Bricksforge's Pro Forms module checks a file's type when it is first uploaded but trusts the file metadata the client sends when the form is submitted, in particular the `url` field of the `temporaryFileUploads` parameter ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)). An attacker obtains a nonce from the unauthenticated `bricksforge_regenerate_nonce` AJAX endpoint, uploads a GIF/PHP polyglot that passes the type check, then submits a form whose `file` path names that image and whose `url` ends in a PHP extension; the plugin writes the image's content to the PHP path and one request to it executes the code ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)). Versions up to and including 3.1.8.9 are affected ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)). The vendor's changelog lists the fix in 4.0.1 ([Bricksforge, 2026-10-08](https://bricksforge.io/version-changelog/)), while Patchstack names 3.1.8.10 as the fixed build of the 3.x line, which the public changelog does not list ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)). Dr. Web credits Wordfence with a CVSS score of 9.8 and Patchstack with 10.0 ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)).

Patchstack's telemetry first recorded exploitation attempts on 2026-10-07 at 21:47 UTC, from 63 distinct source addresses, and it calls the activity automated without attributing it ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)). Patchstack describes exploitation attempts and says an attacker with execution can deploy web shells, modify site content, read data and persist ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)). It counts about 6,000 active installations ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)), Previdian tags the flaw "PoC available" ([Previdian, 2026-10-08](https://previdian.com/CVE-2026-85097)), and the flaw is not in CISA's KEV catalog ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)).

**Exposure:** WordPress sites running Bricksforge versions up to and including 3.1.8.9 ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)) with the Pro Forms module active, including sites whose forms have no upload field ([Bricksforge, 2026-10-08](https://bricksforge.io/version-changelog/)). Patchstack and Dr. Web bound the affected range at 3.1.8.9 ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)), but the vendor's upload fix ships in 4.0.1, the release after 4.0.0 of 2026-09-17, and its changelog gives no affected range, so whether 4.0.0 is affected is not stated ([Bricksforge, 2026-10-08](https://bricksforge.io/version-changelog/)). Bricksforge is not in the wordpress.org plugin directory, so no public version statistics exist, and updates come with an annual licence, so a site with a lapsed licence may not receive the fix ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)).

**Detection:** in web server and WordPress access logs, POST requests to `/wp-json/bricksforge/v1/form_submit` or to admin-ajax with the `bricksforge_form_submit` action that carry a `temporaryFileUploads` value pairing an image path with a PHP-extension destination, preceded by a call to the nonce endpoint and repeated with changing extensions, case or encodings, from 2026-10-07 onward; in file-integrity and endpoint telemetry, new PHP files in the WordPress uploads tree, the plugin's temporary upload folder first, and web requests to them ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)). Patchstack says a site that ran a vulnerable version without protection should have its historical logs and the host reviewed for unexpected PHP files, unusual application activity and unauthorized changes ([Patchstack, 2026-10-08](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)); Dr. Web adds a check of the user list for unknown administrator accounts ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)).

**Defender takeaway:** update every Bricksforge site to 4.0.1, or to 3.1.8.10 on the 3.x line, now; where that is not possible, deactivate Pro Forms or the plugin and block PHP execution in the uploads directory ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)). On a site that was reachable and unpatched since 2026-10-07, run the log and file search above, and if code turns up restore from a backup older than 2026-10-07 and change all passwords ([Dr. Web, 2026-10-09](https://www.drweb.de/bricksforge-sicherheitsluecke-upload-aktiv-ausgenutzt/)).