Bricksforge RCE Exploited in the Wild: Automated Attacks Within Hours of Oct. 7 Disclosure

On Oct. 7, 2026, at 21:47 UTC — mere hours after public disclosure — Patchstack telemetry registered the first active exploits against CVE-2026-85097, a critical vulnerability in the WordPress Bricksforge plugin. The official CVE record assigns a score of 9.8, not the 10.0 echoed across technical outlets. The numerical gap matters less than the weaponization velocity: 63 unique IP addresses, automated patterns, and sequential testing of PHP extension variants against the same target.

The plugin, which extends the Bricks builder with form modules and conditional logic, has become a vector for unauthenticated remote code execution. The root cause is a trust boundary violation: MIME-type validation occurs during the initial upload, but the final file path is derived from a client-controlled field.

How the Trust Boundary Violation Works

The attack chain unfolds in four stages, both documented by Patchstack and confirmed by Wordfence. The attacker first obtains a valid nonce via the bricksforge_regenerate_nonce endpoint, then uploads a GIF/PHP polyglot file to the temporary directory. At this stage, MIME-type validation works correctly: the file passes as an image.

The critical step occurs during form submission. The url field inside the temporaryFileUploads parameter is not re-validated server-side. The attacker can point to the path of the previously uploaded file — with a .gif extension — but make it resolve to an executable .php, .php5, .php7, or .phtml extension. The server writes the file to the final destination using the client-controlled extension.

"Bricksforge validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends. In particular, it does not validate the 'url' field inside the 'temporaryFileUploads' parameter."

According to Patchstack, roughly 95% of observed exploit requests follow this pattern: source path with an image extension (.gif or .png), destination with a PHP extension. The payload consistency suggests shared or commoditized exploit code, not bespoke attacks.

The Automation Numbers: 63 IPs and Two Distinct Clusters

Telemetry reveals a structured campaign, not sporadic isolated attempts. Patchstack identified 63 unique IPs, with 6 addresses accounting for approximately 46% of total requests. Two automation patterns emerge clearly from the analyzed traffic.

In the first cluster, 44 IPs sent 56 requests with identical payloads within time windows measured in seconds. In the second, 3 IPs tested 25 extension and URL-encoding variants against the same temporary file — including case manipulation and double encoding. Both patterns, Patchstack notes, indicate "automated exploitation over rotating proxies or distributed infrastructure" and do not, on their own, allow attribution to a single threat actor.

Observed evasion techniques include alternative extensions (.php5, .php7, .phtml), extension case variation, and single or double URL encoding. Targeted endpoints are /wp-json/bricksforge/v1/form_submit and /wp-admin/admin-ajax.php with action bricksforge_form_submit.

The Official CVSS 9.8 Versus the Headline 10.0

A numerical discrepancy runs through early coverage. The Hacker News and blog.netmanageit.com both report CVSS 10.0 for CVE-2026-85097. The official record on cve.org instead shows 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-434 classification (Unrestricted Upload of File with Dangerous Type).

The difference is not semantic. A 10.0 would require no user interaction, no privileges, network access, and full impact across all three CIA dimensions — conditions the 9.8 vector meets almost entirely, with the exception of unchanged scope (S:U). Editorial score inflation risks eroding defenders' ability to calibrate priorities: when every vulnerability is "maximum," none truly is.

Immediate Actions

WordPress administrators with Bricksforge installed must verify the active version. The vendor has released version 3.1.8.10, which closes the vulnerability; version 4.0.1 is also available. The dossier does not specify whether 4.0.1 introduces additional fixes beyond the one applied in 3.1.8.10.

For systems where immediate updating is not feasible, access logs for the two documented routes — REST API and admin-ajax — must be analyzed, with particular attention to temporaryFileUploads parameters showing a mismatch between source and destination extensions. Patchstack telemetry indicates the campaign is active and expanding: the patching window is measured in hours, not days.

Audit of files in temporary upload directories must include searches for polyglots with double extensions or non-standard PHP extensions (.php5, .php7, .phtml). Post-exploitation persistence — web shells, recurring access, lateral movement — is not quantified in available sources but represents a plausible risk scenario after arbitrary code execution.

A Recurring Pattern, Accelerating Speed

This case fits a class the security sector observes with increasing frequency: form-builder plugins that delegate final path specification to the client after an initial validation that is not replicated at commit time. Bricksforge's logic — MIME verification on upload, trust of the URL field on submission — is not an isolated architecture. The commoditization of the exploit, measured here in dozens of IPs and identical requests within seconds, indicates the window between disclosure and mass weaponization has contracted to a scale that manual patching operations struggle to sustain.

The CVSS discrepancy, finally, raises an editorial and operational question: when technical severity is amplified in transmission, response teams lose the signal-to-noise ratio needed for effective triage. The official 9.8 is already critical. It did not need to become 10.0 to be dangerous.

Information verified against cited sources and current as of publication.

Sources

• https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
• https://www.infosecurity-magazine.com/news/critical-cisco-catalyst-sdwan/
• https://www.darkreading.com/application-security/unsloth-studio-flaw-model-inspection-code-execution
• https://blog.netmanageit.com/attackers-exploit-cvss-10-0-bricksforge-wordpress-flaw-enabling-unauthenticated-rce/
• https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/
• https://www.cve.org/CVERecord?id=CVE-2026-76460
• https://www.cve.org/CVERecord?id=CVE-2026-85097
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog