Bricksforge WordPress flaw under active attack: sites on 3.1.8.9 or older must update
CVE-2026-85097 in the Bricksforge plugin lets attackers upload and run PHP code without logging in. Patchstack has seen exploitation since October 7, 2026, and Bricksforge has shipped a fix.
WordPress security company Patchstack says attackers are exploiting CVE-2026-85097 in Bricksforge, an add-on for Bricks Builder. Its telemetry first picked up attacks on October 7, 2026. On October 8, 2026, Bricksforge released a fix for the Pro Forms file upload issue.
Who is affected
- Patchstack says the flaw affects Bricksforge 3.1.8.9 and earlier and is fixed in 3.1.8.10. It rates the bug CVSS 10.0, the highest severity level.
- Attackers don't need to log in to upload and run PHP code on a site. That lets them plant web shells, change content, read sensitive data and keep access over time.
- Bricksforge's changelog says the bug affects every site with Pro Forms active, even if no form uses an upload field.
Warning signs
- Unexpected PHP files in
/wp-content/uploads/bricksforge/tmp/or other upload folders, especially files namedlogin_admin_*.php. - Many form submissions to
/wp-json/bricksforge/v1/form_submitthat include atemporaryFileUploadsparameter. - HTTP requests to newly created PHP files in upload folders.
What to do
- Update Bricksforge to 3.1.8.10 or later. The newest release listed in the vendor's changelog with the fix is 4.0.1.
- If a site ran a vulnerable version without protection, go through older logs and check the server for unexpected PHP files or unauthorized changes.
- If you're on shared hosting, you can ask your hosting provider to help review the logs.
