In gymnastics, a perfect 10 gets you a gold medal. In vulnerability scoring, it gets you a very long night. Bricksforge, a popular add-on for the Bricks visual builder on WordPress, just earned the maximum CVSS score of 10.0, and attackers are already cashing in.

A GIF That Was Secretly a PHP File

The flaw, tracked as CVE-2026-85097, lets an unauthenticated attacker upload a file and get it executed as PHP on the server, which is security-speak for "full remote code execution, no login required." It affects Bricksforge versions up to and including 3.1.8.9; the fix arrived in 3.1.8.10, and version 4.0.1 is recommended.

The attack chain is almost elegant. Per The Hacker News, an attacker grabs a nonce from a public AJAX endpoint, uploads a GIF/PHP polyglot that sails through the plugin's MIME-type check, then submits a form where the file path points to the "validated" image but the URL field ends in .php. The plugin checked the file once at upload, then trusted client-supplied metadata afterward. Trust, as it turns out, was the vulnerability.

63 IP Addresses and Zero Chill

WordPress security firm Patchstack first spotted exploitation attempts on October 7, 2026, at 21:47 UTC. It has since logged traffic from 63 unique IP addresses, with a handful of sources accounting for roughly 46% of requests, and patterns pointing to automated exploitation through rotating proxies. Translation: this isn't one bored hacker, it's a script sweeping the internet for anyone who hasn't updated.

The angle most people miss is that the site owners hit by this probably never think of themselves as "running Bricksforge." They installed a page builder, then an add-on for the page builder, and now their security depends on a plugin-of-a-plugin they last thought about during the original build. Every add-on you install is a little bit of somebody else's code with a key to your server. The same roundup also flagged lower-severity bugs in WPC Product Bundles for WooCommerce and Ninja Forms, a handy reminder that plugin sprawl is a whole-ecosystem habit.

If you run Bricksforge, update right now and then go hunting for unfamiliar PHP files in your uploads directory, because patching only locks the door; it doesn't evict anyone who already walked in.

Plugin-of-a-plugin risk is exactly the kind of third-party trust problem we break down in our free developer's security checklist for defending against supply-chain attacks, worth a read before your next "quick" plugin install.

Source: The Hacker News