Cybersecurity
Attackers exploit Bricksforge WordPress flaw
Patchstack said attackers had been exploiting a Bricksforge vulnerability that let unauthenticated users upload PHP code, while Wordfence also described separate abuse of two other WordPress plugins and broader WordPress attack trends.
- Patchstack said it detected exploitation of CVE-2026-85097 against Bricksforge on 7 October 2026 at 9:47 p.m. UTC.
- The flaw affected Bricksforge versions up to and including 3.1.8.9, and the article said a patch had been released in 3.1.8.10.
- The reported attack path used a crafted temporaryFileUploads parameter to place PHP code where the server would later execute it.
- Patchstack said it saw 63 unique source IPs, with six of them generating about 46% of the requests.
- The article said Wordfence reported separate abuse of XSS flaws in WPC Product Bundles for WooCommerce and Ninja Forms, and said 2,073 WordPress-related vulnerabilities were published in Q2 2026.
Patchstack said it observed exploitation of Bricksforge on 7 October 2026 at 9:47 p.m. UTC. The flaw was identified as CVE-2026-85097, and the article said it affected Bricksforge releases through 3.1.8.9 before a fix appeared in 3.1.8.10.
Patchstack and Wordfence said an attacker could first obtain a nonce, upload a GIF that also contained PHP, and then send a form submission with manipulated file metadata. The server would trust the submitted URL field and write the file contents to a PHP location, which could lead to code execution when the file was requested.
Patchstack said the activity targeted the Bricksforge form submission endpoint and the WordPress AJAX handler with a crafted temporaryFileUploads parameter. It said two traffic clusters stood out, one involving 44 IPs sending identical requests and another involving three IPs testing multiple PHP extensions and encodings.
The article also said threat actors were abusing cross-site scripting flaws in WPC Product Bundles for WooCommerce and Ninja Forms to deliver a JavaScript file called x.js. Wordfence said that file could be used to install a malicious plugin, create rogue administrator accounts and maintain access, and it said 2,073 WordPress-related vulnerabilities were published in the second quarter of 2026, with about 573,000 sites compromised.
Named in this story
Companies
- Patchstack
- said it detected exploitation and explained the flaw
- Wordfence
- described the exploit chain and gave mitigation advice
Products and systems
- Bricksforge
- was the WordPress plugin affected by the vulnerability
- WordPress
- was the platform on which the vulnerable plugin ran
- WPC Product Bundles for WooCommerce
- was one of two other plugins whose flaws were being abused
- Ninja Forms
- was the other plugin whose flaw was being abused
How the source tells it
A technical security report with an urgent, cautionary register, driven by exploit details and remediation advice.
- urgency it stressed active exploitation, dated detection and immediate update guidance
- alarm it foregrounded maximum-severity language and the prospect of arbitrary code execution and persistent access