Attackers are already hitting a critical file-upload flaw in the Bricksforge add-on for the Bricks WordPress builder. No login is required. A successful upload can execute PHP on the site.
What happened
The issue is CVE-2026-85097. Wordfence scores it CVSS 9.8. Patchstack, which is seeing the attacks, scores it 10.0. SecurityWeek reported on 12 October 2026 that Patchstack first observed exploitation attempts on 7 October.
The bug is in how form submission handles the temporaryFileUploads parameter. The server trusts an attacker-controlled URL field after an earlier upload has already passed a MIME check. That mismatch lets a file land with a PHP extension and run.
Who is affected
Bricksforge versions up to and including 3.1.8.9. The fix is 3.1.8.10. Patchstack says the commercial add-on is used on roughly 6,000 sites. It is not a mass-market plugin, but every site that has it and has not upgraded is a live target. Patchstack described two automated clusters, including 44 addresses sending the same payload within seconds.
What to do now
Upgrade Bricksforge to 3.1.8.10 or later, then look for webshells dropped since 7 October. A patch after compromise does not remove a file that is already on disk.
- Inventory WordPress sites for Bricks and Bricksforge, including agency-built client sites.
- Check temporary upload paths and recent PHP files that do not belong to the theme or known plugins.
- Review new administrator accounts and unexpected scheduled tasks if the site was on 3.1.8.9 or older this week.
Source: SecurityWeek, citing Patchstack telemetry, 12 October 2026. Read the report.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.