Bricksforge, a commercial extension for the Bricks page builder, patched an unauthenticated file upload flaw in version 3.1.8.10. Patchstack recorded automated attempts to exploit it against WordPress sites from early October.
What happened
The flaw sits in how Bricksforge handles form uploads. An attacker first requests a valid nonce from the plugin's AJAX endpoint, then uploads a file that is both a valid GIF and valid PHP into the temporary upload directory, where the MIME type check passes. A second request submits a form whose temporary file reference points at that accepted image but ends in .php, so the file is written and executed as code. No account is needed and the victim does nothing.
The flaw is CVE-2026-85097, rated 9.8, affecting versions up to and including 3.1.8.9. Patchstack's telemetry shows clustering: 44 addresses sent identical payloads within seconds of each other, and a second group cycled 25 PHP extension and encoding variants against the same temporary file. That is automated infrastructure, not a one-off probe.
Who is affected
Any WordPress site running Bricksforge 3.1.8.9 or earlier where Bricks forms are reachable from the internet. Patchstack puts the install base at roughly 6,000 sites, small enough that scanning by path finds them reliably.
- Sites using the Bricks builder with the Bricksforge form element enabled
- Multisite installs, where every subsite is a separate target on the same codebase
- Agencies hosting several client sites under one hosting account
What to do now
Update Bricksforge to 3.1.8.10 or later today, before any other maintenance.
- Check the plugin version in wp-admin; if updates are pinned or disabled, install the build manually
- If the site ran an older build while internet-facing, list .php files under wp-content/uploads and compare them against known plugin paths
- Review administrator accounts and mu-plugins for additions nobody made
- Block requests carrying a temporaryFileUploads parameter at the WAF until the patch is live
- If a shell is found, rotate administrator and database passwords and regenerate the WordPress salts
What this means for South African businesses
Bricks is popular with local design agencies because it builds layouts quickly, and the Bricksforge form is usually the contact path on those sites. Because the attack needs no login and no user action, the plugin version is the only thing standing in the way. My judgment: a small business site on shared hosting is the worst case, because one uploaded shell exposes every other site and mailbox on that account.
Source: SecurityWeek.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.