CVE-2026-85097
Bricksforge WordPress plugin unauthenticated file upload to RCE
Bricksforge, a premium add-on for Bricks Builder, lets unauthenticated attackers upload and run PHP code in versions up to 3.1.8.9. Wordfence scores it CVSS 3.1 9.8 (Critical); Patchstack rates it 10.0. Fixed in 3.1.8.10 and 4.0.0. Patchstack saw exploitation attempts from 7 October 2026. Not in CISA KEV.
- CVSS
- 9.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Class
- RCE
- Status
- Active Exploitation
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Bricksforge
- Products
- Bricksforge (WordPress plugin)
- Affected
- Bricksforge versions up to and including 3.1.8.9. No authentication is required. The vendor says sites with Pro Forms active are exposed.
- Fixed
- 3.1.8.10 and 4.0.0 per the vendor changelog. 4.0.1 (8 October 2026) and 4.0.2 (13 October 2026) add further fixes in the same upload area.
- CWE
- CWE-434
- Published
- 8 Oct 2026
- Updated
- 14 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-85097 is an unauthenticated arbitrary file upload flaw (CWE-434) in Bricksforge. Bricksforge is a commercial add-on for the Bricks Builder site builder on WordPress. An attacker can get PHP code onto the server and run it.
Wordfence, the CNA, published the CVE on 8 October 2026. It scores the flaw CVSS 3.1 9.8 (Critical). Patchstack rates it 10.0. NVD shows the Wordfence score and has deferred its own analysis.
Versions up to and including 3.1.8.9 are affected. The vendor changelog says the flaw was fixed in 3.1.8.10 and 4.0.0. Version 4.0.1 (8 October) fixed a related Pro Forms upload issue. Version 4.0.2 (13 October) added more hardening.
Patchstack reports exploitation attempts in the wild from 7 October 2026 at 22:47 UTC+1. It recorded 63 source IPs. Patchstack did not report a count of compromised sites or name an actor.
The CVE is not in the CISA KEV catalog. Wordfence credits the researcher d.v4n_s3c. Several unvetted GitHub repositories claim exploit code. ThreatWire does not link them.