A CVSS score of 10.0 is the security world's version of a judge holding up a perfect scorecard, except nobody in the audience is clapping. That's the rating Patchstack and The Hacker News gave a flaw in Bricksforge, a plugin that extends the Bricks visual builder for WordPress, and attackers have already taken it for a spin.
A GIF Walks Into a PHP Server
CVE-2026-85097 affects Bricksforge versions up to and including 3.1.8.9 and lets unauthenticated attackers upload and execute arbitrary PHP code. Patchstack spotted exploitation attempts on October 7 at 9:47 p.m. UTC, and The Hacker News points users to update to the latest release, 4.0.1.
The trick is sneaky. The plugin checks a file's MIME type at upload, then later trusts client-supplied metadata when a form is submitted. Attackers grab a valid nonce from an unauthenticated AJAX endpoint, upload a GIF/PHP polyglot that passes as an image, then submit a form whose url field ends in a PHP extension, and the plugin dutifully writes their code somewhere the server will run it. To dodge filters, they rotated through .php5, .phtml, .pHp and URL-encoded variants like %2ephp.
Bots on Rotating Proxies, Not a Lone Genius
Patchstack logged 63 unique source IPs, including one cluster where 44 IPs fired 56 identical requests within seconds and another that tested 25 extension and encoding variations. Translation: this is automated, industrial-scale spraying over rotating proxies. If your site runs a vulnerable Bricksforge version, assume someone has already knocked.
The angle most people miss: updating closes the door but doesn't evict anyone already inside. The recommended cleanup includes checking /wp-content/uploads/bricksforge/tmp/ for unexpected PHP files, auditing requests to /wp-json/bricksforge/v1/form_submit that carry a temporaryFileUploads parameter, and reviewing repeated form submissions. The same report flags attackers abusing XSS bugs in WPC Product Bundles for WooCommerce and Ninja Forms to plant backdoor plugins and rogue admin accounts. Again, patching stops new infections but won't remove existing ones, so look for hidden admins and poke around the must-use plugins directory.
Every plugin is a dependency, and every dependency is somebody else's code running on your server with your name on the front door.
Third-party plugins are a supply chain whether or not anyone calls them one, and our free developer security checklist for defending against supply-chain attacks walks through how to vet and monitor them before the next perfect 10 lands.
Source: The Hacker News