On 8 October 2026 Patchstack reported that Bricksforge, an extension for the Bricks visual builder, is being used in attacks. The vulnerability (CVE-2026-85097) lets a visitor without an account upload a file and run PHP code on the site. Versions up to and including 3.1.8.9 are affected. According to Patchstack the fix is in version 3.1.8.10, and the first attacks were recorded on 7 October.
How the file upload attack on Bricksforge works
The plugin checks the file type only on the first upload. When it receives the form, it trusts the file data from the request and does not check the url field. So the attacker uploads a picture that is also PHP code, and then tells the plugin to save it as a file with a PHP extension. Once they open that file in the browser, the code runs. Patchstack writes that this opens the way to web shells, changes to content, data theft and persistent access.
Patchstack rates the vulnerability 10.0, and the NVD record submitted by Wordfence rates it 9.8. Both scores are in the "critical" category.
Are you affected?
You are affected if you use Bricksforge up to and including version 3.1.8.9. In its entry for 4.0.1 the vendor writes that the problem affects every site with Pro Forms active, even if its forms have no upload field. The version is in Plugins > Installed Plugins, or one command in cPanel's Terminal shows it. If the command returns no line, look for the plugin in the admin as well.
# cPanel > Terminal, in the site's folder
# Read-only. Shows the version of Bricksforge.
wp plugin list --fields=name,status,version | grep -i bricksforge
If the site has run a vulnerable version since 7 October, also check that there are no PHP files in wp-content/uploads. None are expected there. The attacks that Patchstack recorded mention the folders wp-content/uploads/bricksforge/tmp/ and wp-content/uploads/2026/10/, file names such as login_admin_*.php and extensions such as .php5, .phtml and .PHP.
# cPanel > Terminal, in the site's folder
# Read-only. Lists files that can run as PHP.
find wp-content/uploads -type f \
\( -iname '*.php*' -o -iname '*.pht*' -o -iname '*.phar' \)
A file that holds only a comment is harmless. Anything you do not recognise is a reason to act. In the server logs also look for POST requests to the address /wp-json/bricksforge/v1/form_submit, which according to Patchstack is the main target.
What to do
- Back up and update Bricksforge. Patchstack names 3.1.8.10 as the fixed version. The vendor's changelog for 8 October records version 4.0.1 with "Security fix for the Pro Forms file upload", and there is no line for 3.1.8.10. So take the newest version the vendor offers and check that its number is 3.1.8.10 or higher. A backup matters more if the version moves you from 3.x to 4.x.
- Bricksforge is not in the wordpress.org directory, and the sources do not say where the update comes from. Start from the vendor's changelog.
- If you cannot update right away, switch the plugin off until you can. The forms that depend on it will stop working.
- Do the checks above. If you find a PHP file you do not know, the site may have been compromised. Deleting the file alone is not enough, so go through the guide for a hacked site.
What we do
With vulnerability (CVE) monitoring we match the plugins, themes and WordPress on your site against vulnerability databases and tell you what to update before anyone exploits it. If the check above turns up a PHP file you do not know, with hacked site cleanup we remove the malware and the backdoors and close the hole. We do both for your site wherever it is hosted.
Frequently asked questions
What is CVE-2026-85097 in Bricksforge?
A vulnerability in Bricksforge, an extension for the Bricks visual builder, that lets a visitor without an account upload a file and run PHP code on the site. Versions up to and including 3.1.8.9 are affected. Patchstack rates it 10.0 and the NVD record submitted by Wordfence rates it 9.8, both in the "critical" category.
Is the Bricksforge vulnerability already being exploited?
Yes. On 8 October 2026 Patchstack reported that Bricksforge is being used in attacks, with the first ones recorded on 7 October. According to Patchstack the break-in opens the way to web shells, content changes, data theft and persistent access.
Is my site affected if my forms have no file upload field?
Yes, if Bricksforge is on 3.1.8.9 or older and Pro Forms is active. In its entry for version 4.0.1 the vendor writes that the problem affects every site with Pro Forms active, even when its forms have no upload field.
Which version of Bricksforge fixes the vulnerability?
Patchstack names 3.1.8.10 as the fixed version. The vendor's changelog for 8 October 2026, however, records version 4.0.1 with a security fix for the Pro Forms file upload and has no line for 3.1.8.10. Take the newest version the vendor offers and check that its number is 3.1.8.10 or higher.
How do I check my Bricksforge version?
The version is under Plugins > Installed Plugins. In cPanel's Terminal, wp plugin list --fields=name,status,version | grep -i bricksforge run in the site's folder only reads and shows it. If it returns no line, look for the plugin in wp-admin as well.
Where does the Bricksforge update come from?
Bricksforge is not in the wordpress.org directory, and the sources do not say where the update comes from. Start from the vendor's changelog on bricksforge.io. Back up first, especially if the new version moves you from 3.x to 4.x.
How can I tell whether my Bricksforge site has been compromised?
Look for PHP files in wp-content/uploads, where none are expected. The attacks Patchstack recorded mention the folders wp-content/uploads/bricksforge/tmp/ and wp-content/uploads/2026/10/, names such as login_admin_*.php and extensions such as .php5, .phtml and .PHP. In the server logs, look for POST requests to /wp-json/bricksforge/v1/form_submit.
What if I cannot update Bricksforge right away?
Switch the Bricksforge plugin off until you can update it. The forms that depend on it will stop working in the meantime. If you find an unknown PHP file, deleting it alone is not enough, and the site needs to be cleaned as a hacked one.