← Back to the live CVE advisory feed

CVE-2026-85097: Bricksforge

Severity

9.8 (CRITICAL)

Vendor

BRICKSFORGE

Affected versions

0 through 3.1.8.9

Patch status

Unknown

Published

2026-10-08T07:16:31.710

Modified

2026-10-08T07:16:31.710

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Treat internet-facing systems as higher priority.

Technical summary

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

View the official NVD record for CVE-2026-85097

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.