CVE-2026-85097 | defend.network

What is CVE-2026-85097?

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

CVSS9.8 NVD 3.1

SeverityCRITICAL

Exploitation In the wild

EPSS<1% · P22

Triage statusActive Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWECWE-434

NVD published2026-10-08

NVD last modified2026-10-08

Timeline

2026-10-08Published to the U.S. National Vulnerability Database (NVD)
2026-10-13First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Update the Bricksforge plugin to the latest patched version
Disable the plugin if updates are unavailable; consider alternative page builders
Scan WordPress file system and database for unauthorized PHP files or modifications
Review recent file uploads and user activity logs for signs of compromise
Restrict file upload capabilities to authenticated administrative users only

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of October 2026 (October 12 – 18)
WordPress Bricksforge & SonicWall SMA CVSS 10.0 exploits; Ledger spy chips drain wallets (2026-10-13)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.