Detection, verification and incident-response toolkit for CVE-2026-85097: remote Bricksforge assessment, log IOC hunting, filesystem implant audit, plus Sigma and WAF rules.
Unauthenticated Arbitrary File Upload → RCE in the Bricksforge WordPress plugin
Detection, verification and incident-response toolkit for CVE-2026-85097, a CVSS 10.0
unauthenticated arbitrary file upload in the Bricksforge
plugin for WordPress that is actively exploited in the wild.
One script, three modes: remotely assess a target, hunt historical logs for exploitation, and audit a web root for dropped implants.
____ _ _ _ __ ___ _ _
| __ ) _ __(_) | _| | __/ _| ___ _ __ __ _ / _ \ ___| | _| | ___ _ __
| _ \| '__| | |/ / |/ / |_ / _ \| '__/ _` | | | / __| |/ / |/ _ \| '_ \
| |_) | | | | <| <| _| (_) | | | (_| | |_| \__ \ <| | (_) | | | |
|____/|_| |_|_|\_\_|\_\_| \___/|_| \__, |\___/|___/_|\_\_|\___/|_| |_|
|___/
CVE-2026-85097 | Unauthenticated Arbitrary File Upload -> RCE
CVSS 10.0 CRITICAL | Bricksforge <= 3.1.8.9 | Fixed 3.1.8.10
| Field | Value |
|---|---|
| CVE | CVE-2026-85097 |
| Product | Bricksforge (WordPress plugin, addon for Bricks Builder) |
| Type | Unauthenticated Arbitrary File Upload → Remote Code Execution |
| CWE | CWE-434: Unrestricted Upload of File with Dangerous Type |
| CVSS | 10.0 CRITICAL: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (vector inferred, see Limitations) |
| Authentication | None |
| Affected | <= 3.1.8.9 |
| Fixed | 3.1.8.10 (vendor release line referenced in press: 4.0.1) |
| Exploitation | ACTIVE IN THE WILD |
| First observed | 2026-10-07 21:47:17 UTC |
| Installations | ~6,000 |
| Source IPs observed | 63 unique (top 6 ≈ 46% of requests) |
| Primary endpoint | POST /wp-json/bricksforge/v1/form_submit |
| Fallback endpoint | POST /wp-admin/admin-ajax.php (action=bricksforge_form_submit) |
| Implant naming | login_admin_*.php |
[!CAUTION] Authorized use only. This tool is for permitted security assessment, defensive validation and incident response. Running any active test against a system you do not own or have written permission to test is illegal in most jurisdictions. See SAFETY-AND-LEGAL.md.
Bricksforge extends Bricks Builder with advanced forms,
animations and dynamic data. Its Pro Forms feature accepts file uploads. The plugin
correctly validates the MIME type of a file when it is first uploaded, but when the
form is later submitted, it trusts the file metadata the client sends, and never
validates the url field inside the temporaryFileUploads parameter.
That single missing check converts a benign image upload into unauthenticated remote
code execution. An attacker needs no account, no CSRF token they cannot mint
themselves, and no user interaction. Patchstack observed exploitation beginning
2026-10-07 21:47:17 UTC from 63 unique source IPs spanning datacenter, cloud, VPN and
residential infrastructure.
file (the server-side path that was MIME-checked) and url (the destination the plugin
will write to) are decoupled. The plugin re-reads the client-supplied url at
submission time and writes the staged bytes there.
{
"temporaryFileUploads": [
{
"field": "form-field-file",
"file": {
"file": "/var/www/example.com/wp-content/uploads/bricksforge/tmp/img_example.gif",
"url": "https://example.com/wp-content/uploads/bricksforge/tmp/img_example.php",
"type": "image/gif"
}
}
]
}
The signature is the mismatch: the server-side path is a .gif, the destination URL
is a .php. In 95% of captured requests the server-side path ended in .gif or .png.
| File | Role |
|---|---|
wp-content/plugins/bricksforge/includes/elements/pro-forms/actions/init.php | Injection point: client-supplied metadata (including url) is merged into the form-action context without validation. |
wp-content/plugins/bricksforge/includes/elements/pro-forms/actions/base.php | Sink: the trusted metadata drives the final file write, so the attacker controls the on-disk destination filename and extension. |
| # | Step | Observable |
|---|---|---|
| 1 | Obtain an unauthenticated nonce: POST /wp-admin/admin-ajax.php with action=bricksforge_regenerate_nonce. No auth required; returns a valid nonce. | admin-ajax.php request with action=bricksforge_regenerate_nonce |
| 2 | Upload a GIF/PHP polyglot: a valid image that also carries PHP code. MIME validation is performed here, so it passes and lands in wp-content/uploads/bricksforge/tmp/. | Multipart upload writing into /wp-content/uploads/bricksforge/tmp/ |
| 3 | Submit the form with mismatched metadata: file points at the validated .gif, url ends in .php. | form_submit request containing temporaryFileUploads |
| 4 | Plugin writes the contents to the PHP location → RCE. Requesting that URL executes the embedded code: web shells, content modification, data theft, persistence. | HTTP GET to a newly created .php file under an uploads directory |
Attackers actively probe for ways around extension filtering. Four families:
| Family | Samples | Intent |
|---|---|---|
| Alternative PHP extensions | .php .php5 .php7 .php8 .phtml .pht .phtm .phps | Reach a PHP handler under a name the filter does not block |
| Case manipulation | .PHP .Php .pHp .PHTML | Defeat case-sensitive blacklists; Windows/some Apache configs resolve case-insensitively |
| Encoded extensions | %2ephp .%70hp .%2570%2568%2570 | Smuggle the extension past a filter inspected before URL-decode |
| Modified metadata | altered/missing path, name, originalFilename, url | Map which fields the plugin actually validates |
This tool detects all 18 variants of the first three families (see Validation results).
Requires Python 3.9+. Only two dependencies, both common.
git clone https://github.com/Masriyan/CVE-2026-85097.git
cd CVE-2026-85097
python3 -m venv .venv && source .venv/bin/activate # optional but recommended
pip install -r requirements.txt
chmod +x bricksforge_checker.py
./bricksforge_checker.py --version
rich is optional, without it the tool falls back to plain ANSI output and still runs
on a bare host.
Verify the detection primitives before trusting a run: