Read the docs
TI-2026-69443 Aliases CVE-2026-85097

Unrestricted file upload in Bricksforge WordPress plugin lets attackers run PHP

Priority MEDIUM 55CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to and including 3.1.8.9. Insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission lets an unauthenticated attacker upload a GIF/PHP polyglot file with a .php extension to the server (CWE-434). An attacker can obtain a valid nonce through the bricksforge_regenerate_nonce AJAX endpoint and then execute arbitrary PHP code on the server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03287 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BricksforgeBricksforgeup to 3.1.8.9—No fix listedCNA
  • Bricksforge VendorBricksforge Affected up to 3.1.8.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Bricksforge.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-85097
  2. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2026-58311 WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-12594 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter CVSS 3.1CRITICAL 9.8
  • TI-2024-20620 WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-27120 WordPress Bricksforge plugin <= 3.1.8.4 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-20619 WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-20618 WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary Email Sending vulnerability CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences