the Bricksforge upload flaw (CVE-2026-85097): Active Attacks, a Missing Changelog, and a Second Flaw

The Bricksforge security story took a stranger turn this week. Patchstack’s monitoring first recorded exploitation attempts against the Bricksforge upload flaw (CVE-2026-85097) at 21:47 UTC on October 7, 2026, from 63 distinct IP addresses — a critical unauthenticated arbitrary file upload flaw that can lead to full remote code execution. And then independent analysis published October 13 revealed something genuinely odd: the vendor’s own changelog at bricksforge.io carries no dated entry for version 3.1.8.10 — the version every security advisory names as the fix. On top of that, the 4.0.1 release (October 8) disclosed a second security fix in the same code path: a Pro Forms file-upload flaw affecting every site with Pro Forms active, including sites whose forms have no upload fields at all. If you run Bricksforge, there are now two reasons to update — and one reason to double-check what version you are actually on.

What Happened with the Bricksforge upload flaw (CVE-2026-85097)

CVE-2026-85097 is an unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin, affecting versions up to and including 3.1.8.9. Patchstack assigned it the maximum severity score of 10.0, while the official CVE record maintained by Wordfence rates it 9.8 on the CVSS 3.1 scale. Both assessments identify the same risk: an attacker with no account can upload and execute arbitrary PHP on a vulnerable site — a complete takeover vector.

The attack telemetry is unusually detailed. Patchstack logged exploitation attempts from 63 distinct source IPs starting October 7 at 21:47 UTC, with clusters showing coordinated, automated activity. One cluster involved 44 addresses sending 56 identical requests within seconds. Another involved three addresses testing 25 variations of file extensions and encoding against the same temporary file, suggesting attempts to evade controls designed to reject executable uploads. Almost every captured attempt targeted the /wp-json/bricksforge/v1/form_submit endpoint (one used /wp-admin/admin-ajax.php with the bricksforge_form_submit action). In 95 percent of requests, the server path ended in .gif or .png — often paired with a PHP destination URL — and attackers tested extensions including .php5, .php8, and .phtml alongside mixed capitalization and encoded filenames. Some attempted to place login_admin_*.php files outside the temporary directory, in regular WordPress upload folders. The attack also used the publicly accessible bricksforge_regenerate_nonce AJAX action to obtain a valid request token.

Then came the changelog mystery. Patchstack’s advisory says the fix is available in version 3.1.8.10, and the CVE record’s affected range stops at 3.1.8.9 inclusive. But read the vendor’s changelog twice — it returns only three dated sections: 4.0.1 on October 8, 4.0.0 on September 17, and 3.1.8.9 on August 28. No 3.1.8.10 section. The version number appears exactly once on the page, inside the 4.0.1 entry, which says the arbitrary file upload issue tracked as CVE-2026-85097 “was previously fixed in 3.1.8.10 and in 4.0.0.” So the vendor’s own release note is simultaneously the only published confirmation that 3.1.8.10 exists as a fix — and the reason sites on 4.0.0 needed to look at 4.0.1 at all, since the CVE record’s default status reads 4.0.0 as unaffected.

That 4.0.1 entry discloses the second flaw: a security issue in the Pro Forms file upload, affecting every site with Pro Forms active — including sites whose forms use no upload fields. Updating is strongly recommended, and forms with upload fields keep working exactly as before. The 4.0.1 entry also notes that the Pro Forms temporary upload folder now always carries its own protection against anything being executed inside it — a defense-in-depth measure that tells you what the fix is defending against.

A week later, Bricksforge 4.0.2 arrived on October 13 with additional security hardening across REST endpoints, strengthened protections around temporary uploads, and a correction to an image-upload problem introduced in 4.0.1. The layering of fixes — 3.1.8.10, 4.0.0, 4.0.1, 4.0.2 — suggests the vendor is still tightening the same upload-handling code. For defenders, the Bricksforge upload flaw is a reminder to verify fixes, not just install them.

Who Is Affected by the Bricksforge upload flaw (CVE-2026-85097)

The Bricksforge upload flaw (CVE-2026-85097) exposure has several layers, and you need to check which apply:

• Sites on Bricksforge 3.x up to and including 3.1.8.9. This is the documented vulnerable range for CVE-2026-85097. Update to 3.1.8.10 or later — though given the missing changelog entry, verifying your actual installed version matters more than trusting dashboard update badges.
• Sites on Bricksforge 4.0.0. The CVE record reads 4.0.0 as unaffected by CVE-2026-85097, but the vendor’s 4.0.1 entry discloses the second Pro Forms upload flaw, which hits every site with Pro Forms active — even forms with no upload fields. If you are on 4.0.0, 4.0.1 is not optional.
• Sites on 4.0.1. Update to 4.0.2 for the REST endpoint hardening and the temp-upload protections, plus the image-upload regression fix.
• Every site that was exposed between October 7 and its patch date. Patching the Bricksforge upload flaw stops future exploitation but does not remove a web shell an attacker already planted. Sites running a vulnerable version while exploitation was active should be treated as possibly compromised, not merely unpatched.

One structural complication: Bricksforge is distributed commercially, not through the WordPress.org plugin directory. Administrators must update through the plugin’s own update mechanism and keep their license status current — do not assume protection just because the WordPress dashboard shows no pending update.

Why the Bricksforge upload flaw (CVE-2026-85097) Matters

The Bricksforge upload flaw (CVE-2026-85097) incident matters on three levels. Technically, it is a textbook case of how a single file-upload code path can threaten an entire site: unauthenticated arbitrary upload plus executable temp files equals remote code execution, and the attack data shows adversaries probing exactly that boundary with 25 extension and encoding variations. The Pro Forms disclosure adds a sobering twist — a flaw affecting sites whose forms have no upload fields at all means the attack surface is the plugin’s upload plumbing, not any visible feature you chose to enable.

Communicationally, the missing 3.1.8.10 changelog entry is a problem of its own. Security advisories across the industry tell administrators to update to 3.1.8.10 or later, yet the vendor page offers no dated entry for that version. Administrators who verify patches against changelogs — the careful ones — find nothing to verify. The 4.0.1 entry’s one-line mention is doing a lot of heavy lifting. Patch hygiene for the Bricksforge upload flaw is not just shipping a fix; it is giving defenders something to confirm they have it.

And operationally, the 4.0.2 follow-up with REST endpoint hardening suggests the vendor is still discovering the blast radius of this code path. When a vendor ships security fixes three weeks running in the same area, prudent site owners treat the latest release as the baseline and keep watching the changelog for further Bricksforge upload flaw fixes.

What to Do Now About the Bricksforge upload flaw (CVE-2026-85097)

Do not just click update and move on. Work through these steps:

1. Verify your installed Bricksforge version directly. Check the plugin’s own version reporting — not just the WordPress dashboard badge, since Bricksforge updates through its own mechanism. You want 3.1.8.10+ on the 3.x line, or 4.0.2 (the latest documented release) on the 4.x line.
2. Update immediately to close the Bricksforge upload flaw. Get the latest supported release. On 4.x, that means 4.0.2 — it contains the Pro Forms fix from 4.0.1 plus the REST hardening. If an immediate update is impossible, Patchstack’s RapidMitigate rule blocks known exploitation attempts at the traffic layer as a temporary measure.
3. Investigate for compromise if the Bricksforge upload flaw was reachable on your site. Check /wp-content/uploads/bricksforge/tmp/ and other upload directories for unexpected PHP files. Review access logs for requests to /wp-json/bricksforge/v1/form_submit with temporaryFileUploads parameters, and look for new administrator accounts or unknown files. Remove web shells, restore from a known-clean backup if you cannot account for every change, then rotate all WordPress credentials, salts, database passwords, and hosting credentials.
4. Harden the upload attack surface. Disable direct PHP execution in the uploads directory at the server level — that one control would have neutered this entire exploit chain. Keep plugins and themes updated automatically where possible, and remove plugins you do not actively use. Consider a WAF with virtual patching for the window between future Bricksforge upload flaw disclosures and your update.

the Bricksforge upload flaw (CVE-2026-85097): Frequently Asked Questions

Which Bricksforge versions fix CVE-2026-85097?
Patchstack identifies 3.1.8.10 or later as the fix for 3.x installations, and the vendor’s 4.0.1 changelog entry confirms the flaw was also fixed in 4.0.0. However, 4.0.0 sites still need 4.0.1+ for the separate Pro Forms upload flaw. The current best baseline is 4.0.2 (released October 13).

Why is there no 3.1.8.10 changelog entry?
The vendor’s changelog page shows dated entries only for 4.0.1, 4.0.0, and 3.1.8.9. The string “3.1.8.10” appears once, inside the 4.0.1 entry confirming it as a prior fix. No separate dated entry exists for the Bricksforge upload flaw — an unfortunate documentation gap that independent analysts have flagged.

Does the Pro Forms flaw in 4.0.1 affect sites without upload fields?
Yes. The vendor explicitly states the issue affects every site with Pro Forms active, including sites whose forms use no upload fields. The temporary upload folder now carries its own execution protection.

I was on a vulnerable version during the October 7–patch window. Am I safe after updating?
Not automatically. Updating stops future exploitation but does not remove backdoors already planted. Treat the site as possibly compromised: inspect upload directories, review logs, rotate credentials, and restore from a clean backup if anything is unexplained.

Conclusion

the Bricksforge upload flaw (CVE-2026-85097) is the rare vulnerability story where the disclosure mechanics are almost as instructive as the flaw: 63 attacking IPs, automated extension-evasion probing, a fix version with no changelog entry, and a second upload-path flaw disclosed a day later affecting even forms without upload fields. The technical lesson of the Bricksforge upload flaw is familiar — never trust file uploads, never let temp folders execute code — but the operational lesson is the one to act on: verify your actual installed version through the vendor’s own mechanism, land on 4.0.2 (or 3.1.8.10+), and investigate any exposure during the active-exploitation window as a possible compromise, not just a patch to apply. Security maintenance is not a one-click chore; it is verification plus investigation. If you would rather have a team handle updates, monitoring, and incident checks for you, Qamar Digital Ventures LLC‘s website care plans cover exactly that — Worried the Bricksforge upload flaw touched your site? contact us for a security check and cleanup plan. Visit https://qamardigitalventuresllc.com/ to see what’s included.

Sources

• the Bricksforge upload flaw (CVE-2026-85097) is exploited from 63 addresses — Severity Daily
• Bricksforge Version Changelog
• the Bricksforge upload flaw (CVE-2026-85097): Fix Critical RCE Flaw — eSecurity Planet
• WordPress Plugin Vulnerability Exploited in Attacks — CyberSecurityNews
• Attackers Are Exploiting a CVSS 10.0 Bug in Bricksforge — PlayCISO