Bricksforge WordPress Plugin <=3.1.8.9 - Unauthenticated Arbitrary File Upload

Bricksforge WordPress plugin versions up to and including 3.1.8.9 are vulnerable to unauthenticated arbitrary file upload leading to remote code execution. An attacker obtains a wprest nonce via the bricksforgeregeneratenonce AJAX action, uploads a GIF/PHP polyglot through the formfileupload REST...

WordPress Bricksforge 3.1.8.9 Unauthenticated Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability via the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot and verifies PHP execution. https://packetstorm.news/download/236057...

Exploit for CVE-2026-85097

CVE-2026-85097 Bricksforge = 3.1.8.9 unauthenticated file...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload flaw that can result in PHP code execution. The included proof of concept demonstrates the issue with a GIF/PHP marker polyglot. https://packetstorm.news/download/235859...

WordPress Bricksforge 3.1.8.9 Arbitrary File Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability that allows remote code execution. The included proof of concept uploads a GIF/PHP polyglot and abuses temporaryFileUploads to select a PHP filename...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions 3.1.8.9 and prior contain an unauthenticated arbitrary file upload vulnerability through manipulated temporary upload metadata. The included proof of concept uses an inert GIF canary to validate the arbitrary file-write condition...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in temporaryFileUploads that can permit PHP code execution. https://packetstorm.news/download/235378...

Exploit for CVE-2026-85097

CVE-2026-85097 - Bricksforge Word...

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 CVSS score: 10.0, which allows unauthenticated attackers to upload and execute arbitrar...

PT-2026-110867

Attackers exploited CVE-2024-85097, a critical CVSS 10.0 WordPress vulnerability, using GIF/PHP polyglot files to achieve unauthenticated remote code execution. Campaign involved 63 unique IP addresses targeting Bricksforge plugin installations for web shell deployment. ZeroDay WordPressSecurity ...

Exploit for CVE-2026-85097

FOFA DORK...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot, writes it with a .php extension, and verifies command execution...

CVE-2026-85097

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

EUVD-2026-94793

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

CVE-2026-85097

The Bricksforge plugin for WordPress (versions up to and including 3.1.8.9 ) is vulnerable to unauthenticated arbitrary file upload . The root cause is insufficient validation of the attacker-controlled URL field within the 'temporaryFileUploads' parameter during form submission. An unauthenticat...

CVE-2026-85097: Unrestricted Upload of File with Dangerous Type

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

PT-2026-107851

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10 Description The Bricksforge plugin for WordPress contains a flaw allowing unauthenticated attackers to upload and execute arbitrary PHP code on the server. The issue stems from insufficient validation of...

WordPress Bricksforge plugin <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin Bricksforge versions = 3.1.8.9...