Bricksforge RCE Makes WordPress Temp Folders a Host Problem

Patchstack logged no-login remote code execution attempts against the Bricksforge WordPress plugin on October 7, 2026, at 21:47 UTC. The flaw, CVE-2026-85097 in the CVE catalog, is scored 10.0 and hits versions through 3.1.8.9.

Attackers did not need an account. They needed a live Pro Forms endpoint, a nonce anyone could request, and a server willing to run PHP from an uploads folder. Version 4.0.2, shipped October 13, finally told that temp folder to stop executing code. The files dropped before that patch do not leave on their own.

How the Bricksforge RCE Lands Without a Login

Bricksforge is a paid “Swiss Army knife” addon for Bricks, the visual builder. It stacks animations, backend screens, and Pro Forms on top of a Bricks site. Patchstack puts the install base at about 6,000 sites, small next to Elementor, and concentrated on agency and client builds that already paid for Bricks.

The hole sits in form handling, not in the builder canvas. A file is checked when it first arrives. On submit, the plugin then trusts metadata the client sends, including a url field inside temporaryFileUploads that is never checked against the file that passed the type test.

Bricksforge validates a file’s MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends.

Patchstack advisory, October 8, 2026

Wordfence, which catalogued the bug after researcher d.v4n_s3c, laid out the same four beats. Anyone can pull a nonce from the unauthenticated bricksforge_regenerate_nonce AJAX action. A GIF that also holds PHP (a polyglot) passes the MIME check and lands in /wp-content/uploads/bricksforge/tmp/. A later form post keeps that image path in the file field and sets url to a name ending in.php,.phtml,.php7, or a mixed-case or encoded twist of the same idea. The plugin writes the bytes where the url points. A request to that path runs the embedded code.

Patchstack’s telemetry is blunt about volume and shape. All but one captured attempt posted to /wp-json/bricksforge/v1/form_submit. The leftover hit /wp-admin/admin-ajax.php with action bricksforge_form_submit. In 95% of those requests the server-side path ended in.gif or.png while the destination looked like PHP. Most stayed in the Bricksforge temp folder. Some aimed at the ordinary dated uploads tree, including /wp-content/uploads/2026/10/.

Two clusters stood out. Forty-four IPs sent 56 identical payloads within seconds of each other. Three other IPs tried 25 extension and encoding variants against the same temp file. Patchstack recorded 63 unique sources and said the six busiest accounted for about 46% of requests, a share of traffic, not of the IP list. The mix ran through Azure, Tencent, HostRoyale, Cloudzy, and a Brazilian fixed-line address, 177.75.57.20, with almost no prior abuse history. That is rotating infrastructure, not a single noisy bot.

Version 4.0.2 Finally Stops PHP in the Temp Folder

The Bricksforge arbitrary file upload record names 3.1.8.10 as the patched 3.x release. The vendor changelog is more tangled, and that tangle is the hosting problem.

Bricksforge 4.0.0, dated September 17, 2026, says it already bundled 3.x security fixes, including this file-upload bug. Then 4.0.1, dated October 8, one day after the first logged attacks, shipped a separate Pro Forms file upload security fix. The note is wider than the CVE range.

A security issue in the Pro Forms file upload has been fixed. It affects every site with Pro Forms active, including sites whose forms use no upload fields, so updating is strongly recommended. Related: CVE-2026-85097, an arbitrary file upload in the same area that was fixed earlier in 3.1.8.10 and in 4.0.0.

Bricksforge changelog, version 4.0.1, October 8, 2026

A contact form with no file field was not an exemption. If Pro Forms was on, the vendor wanted the site moved. Forms with upload fields, it said, keep working as before.

Five days later, 4.0.2 did the job a host should have been doing anyway. The Pro Forms temp folder “now always carries its own protection against anything being executed inside it.” REST endpoints for form submit, CAPTCHA, templates, and media were tightened. Reading stored submissions now needs an editor-level account. Clearing that table is reserved for administrators. Stored API keys are filtered harder before they reach the front end, and the vendor told operators to renew those keys. Hourly cleanup of the temp folder is kept scheduled so old files do not sit there on long-running sites.

That sequence is the second punch. Closing the url-trust bug stopped new polyglots from being renamed as PHP. Stopping PHP from running inside the temp folder is what turns a leftover file into inert bytes. Sites that updated to 3.1.8.10 or 4.0.1 and never reached 4.0.2 still have a folder that may execute whatever was already written there.

Agencies and Hosts Inherit the Shells

Bricksforge is not in the wordpress.org directory. Updates travel with a paid license, through the vendor dashboard, not through the same cron that bumps Ninja Forms or WooCommerce. An expired seat can sit on 3.1.8.9 with no admin nag that looks like a core update. Agencies that sold a Bricks stack as a cleaner, more professional alternative to Elementor now have a commercial addon whose forms endpoint was scanned by dozens of IPs the evening before the public note.

A retainer that says “we manage WordPress” often means core, the theme, and directory plugins. It does not always mean a Saarbrücken addon that lives under its own admin menu. The quiet copy is a marketing site on a client’s shared plan, Pro Forms on, no file field, logs nobody reads. That is the box a host sees when malware scans light up /wp-content/uploads/bricksforge/tmp/ and neighboring accounts start sharing an IP reputation hit.

Belgium’s Centre for Cybersecurity posted an actively exploited warning for CVE-2026-85097 on October 15. By then the vendor had already shipped 4.0.2. The remaining work is on disk: unexpected PHP under uploads, new admin users, and outbound calls from a site that should only be serving pages.

Hosts that already deny PHP in wp-content/uploads were ahead of the plugin. A polyglot that is renamed to.php does nothing useful if the handler never runs it. Many shared stacks still treat that folder as a normal PHP tree, which is why a form bug becomes a server incident instead of a failed upload.

Three Unauthenticated Criticals Hit Bricksforge in 2026

This file-upload hole is not a one-off on a sleepy plugin. Wordfence’s product file lists eight Bricksforge plugin vulnerability entries. Five of those rows are dated in 2026, and three of them are unauthenticated criticals, including this one.

BRICKSFORGE FLAWS DATED IN 2026

Pro Forms keeps showing up. fieldIds in July, password reset in August, file url trust in October. An addon that is sold as native-feeling Bricks tooling has been a repeating no-login surface for most of the year. The October campaign is the one that showed up in logs as automated GIF-to-PHP writes, which is why hosts are the ones pulling files out of tmp.

Ninja Forms and WPC Planted Hidden Admins the Same Week

The Bricksforge scans did not arrive in a quiet week. Patchstack had already watched a stored XSS campaign walk into two unrelated plugins and finish as a persistence kit inside a logged-in admin’s browser.

THE OCTOBER PLUGIN WEEK

1. October 4, 2026: Exploitation of CVE-2026-93836 in WPC Product Bundles for WooCommerce (through 8.6.6, more than 30,000 sites, score 7.1). The script rides in WooCommerce order data.
2. October 5, 2026: The same second-stage JavaScript, served as x.js, hits CVE-2026-94504 in Ninja Forms (through 3.15.3, more than 500,000 sites, score 7.1) through form submissions.
3. October 7, 2026: First Bricksforge CVE-2026-85097 attempts at 21:47 UTC, no login required.
4. October 8, 2026: Bricksforge 4.0.1 and Patchstack’s public Bricksforge write-up.
5. October 13, 2026: Bricksforge 4.0.2 hardens REST endpoints and blocks execution in the temp folder.

When an administrator opened the poisoned order or form row, the script used that session to install a fake plugin, WP Smart Thumbnails 1.2.4, credited to “MediaPress Labs.” Patchstack called it a post-exploitation implant. It created a visible administrator, a second administrator hidden from the Users screen, a magic login URL that signed the holder in as the site’s oldest administrator, and an unauthenticated file manager. Some pieces load as must-use plugins, so they survive a normal plugin delete.

Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7 stop new injections. They do not remove a hidden admin, a must-use dropper, or that file manager. That is a database and mu-plugins job, not a changelog bump. Bricksforge is the opposite shape, no-login RCE instead of an admin’s browser, but the cleanup rhyme is the same: the patch is necessary and not sufficient if the site was reachable in early October.

What to Hunt in wp-content/uploads

A version number of 4.0.2 in the plugins screen is the start of the ticket, not the end. The useful evidence is on the filesystem and in the access log, dated from October 7 onward.

HOST CHECKS AFTER A BRICKSFORGE UPDATE

• Temp PHP: List /wp-content/uploads/bricksforge/tmp/ for.php,.phtml,.php5,.php7,.php8,.pht,.phtm,.phps, and mixed-case twins of those suffixes.
• Dated uploads: Repeat the same search under /wp-content/uploads/2026/10/ and any other writable media folder, because some payloads left the tmp path.
• Form routes: Grep for POST /wp-json/bricksforge/v1/form_submit bodies that contain temporaryFileUploads, and for admin-ajax.php with bricksforge_form_submit.
• Nonce then upload: A bricksforge_regenerate_nonce call followed quickly by an upload and a form post is the four-step chain in log form.
• Extension fuzz: Repeated submits that only change.php to.PHP,.%70hp, or.%2570%2568%2570 are scanners, even when the WAF returned 403.
• Keys and users: After 4.0.2’s front-end key warning, rotate API keys stored in Bricksforge tools, then look for admin users you did not create.

Do not open a suspect PHP URL in a browser to “see if it runs.” Copy the file off-box, hash it, and inspect it on a machine that is not the web node. If PHP in uploads still executes, that is a panel or vhost change, not a plugin setting, and it should be denied for every site on the server, Bricks or not.

573,000 Infected Sites in One Quarter

The October week sits on a louder Q2. Wordfence’s quarterly threat report added 2,073 WordPress flaws, down 24.3% from the prior quarter, while high-threat entries rose 15.2% to 182. Common and dangerous flaws jumped 80.3% to 357. The firewall blocked 10.4 billion attack requests, up 14.3%, and brute-force defenses stopped 18.2 billion login tries, up 13.8%. Malware findings reached 573,000 WordPress sites infected in Q2, up 21.0%. Wordfence says it handled 47.4% of the quarter’s disclosures and 53.3% of the high-threat set.

Q2 2026 WORDFENCE SNAPSHOT

• New flaws: 2,073 published, down 24.3% quarter over quarter.
• High threat: 182, up 15.2%, the class most likely to become mass scans.
• Infected sites: 573,000, up 21.0%.
• Still scanned: Years-old file-upload and privilege bugs, including CVE-2016-15042 in Frontend File Manager, remain in the top targeted set.

That last row is the habit this Bricksforge bug joined. Attackers still mine arbitrary file upload in WordPress because uploads directories still run PHP on a lot of hosts. A 2026 commercial addon reimplemented a 2016 class of failure: trust the name the client sends after you already inspected the bytes.

Frequently Asked Questions

Is Bricksforge the Same Product as Bricks Builder?

No. Bricks is the visual site-building theme. Bricksforge is a separate paid addon sold from bricksforge.io, with its own dashboard, Pro Forms module, and license. A site can run Bricks without Bricksforge, and only the addon’s versions through 3.1.8.9 are in the CVE-2026-85097 range.

Does Updating Bricksforge Remove a Web Shell Already on Disk?

No. 3.1.8.10, 4.0.0, 4.0.1, and 4.0.2 close the write path and, from 4.0.2, add execute protection in the temp folder. They do not delete PHP that was already placed under /wp-content/uploads/bricksforge/tmp/ or under dated uploads. Those files have to be found and removed, and admin accounts have to be checked by hand.

Can a Contact Form With No File Field Still Be Hit?

For the extra Pro Forms issue fixed in 4.0.1, the vendor said yes if Pro Forms is active, even when no upload field is on the form. Treat every Bricksforge site with Pro Forms enabled as in-scope for the October 8 update, then move to 4.0.2 so the temp folder cannot run leftover code.

Why Did Attackers Bother With.phtml and %70hp?

Many hosts and WAFs only block a lowercase.php suffix. Patchstack saw probes for.php5,.php7,.php8,.phtml,.pht,.phtm,.phps, mixed case such as.PHP and.pHp, and encodings such as %2ephp,.%70hp, and.%2570%2568%2570. A hunt that greps only for.php will miss the rest.

Should a Host Block PHP Under All of wp-content/uploads?

Yes, as a server default, not as a per-plugin tweak. WordPress core does not need to run PHP from uploads, and a plugin that does is acting like a dropper. Blocking.php,.phtml, and the phpN family in that tree would have turned this unauthenticated WordPress RCE exploit into a failed write even before 4.0.2 shipped its temp-folder guard.

If a Bricksforge site was on 3.1.8.9 or earlier anytime after October 7, 2026, treat 4.0.2 as the floor and then open the temp folder. The changelog can wait until the PHP files are gone.