Attackers Exploit CVSS 10.0 Bricksforge Word Press Flaw Enabling Unauthenticated RCE
Summary: Patchstack detected active exploitation on October 7, 2026, at 9:47 p.m. UTC of CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin through version 3.1.8.9 that lets unauthenticated attackers upload and execute arbitrary PHP code. The flaw stems from the plugin validating a file's MIME type on first upload but trusting client-sent metadata in the 'temporaryFileUploads' parameter on form submission, allowing a GIF/PHP polyglot to be referenced with a .php url field; patches are in 3.1.8.10 and 4.0.1.
What you should know: Patchstack recorded the activity from 63 unique source IPs, with six accounting for roughly 46% of all requests and one cluster sending 56 identical requests from 44 IPs within seconds - automated exploitation that does not wait for a patch cycle.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-85097CVE-2026-93836
- Related
- ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, Shiny Hunters Arrest, AI-Fooling Malware and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026