CVE-2026-85097
Received Received - Intake

Unauthenticated Arbitrary File Upload in Bricksforge WordPress Plugin

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Wordfence

Description
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-85097
EUVD
EUVD-2026-94793

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Bricksforge Bricksforge 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Bricksforge WordPress plugin up to version 3.1.8.9 has an unauthenticated arbitrary file upload vulnerability. Attackers can bypass MIME validation by first obtaining a valid nonce, uploading a GIF/PHP polyglot file, then tricking the server into treating it as a PHP file through a crafted parameter. This allows execution of arbitrary PHP code on the server.

Detection Guidance

Check for unauthorized PHP files in WordPress upload directories, particularly in the temporary upload folder. Look for files with double extensions like .gif.php or unexpected PHP files in the /wp-content/uploads/bricksforge/ directory. Review server access logs for POST requests to /wp-admin/admin-ajax.php with the action parameter set to bricksforge_regenerate_nonce or temporaryFileUploads.

Impact Analysis

An attacker could exploit this to take full control of your WordPress site, steal sensitive data, install malware, or use your server for malicious activities. Since no authentication is required, any visitor could potentially compromise your site.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting personal and health data. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Immediately update the Bricksforge plugin to the latest version if available. If not, disable the plugin until a patch is released. Restrict write permissions on the WordPress upload directory to prevent unauthorized file uploads. Monitor server logs for suspicious activity and consider implementing a web application firewall to block exploit attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85097. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart