Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 CVSS score: 10.0, which allows unauthenticated attackers to upload and execute arbitrar...

CVE-2026-85097

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

EUVD-2026-94793

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

CVE-2026-85097

The Bricksforge plugin for WordPress (versions up to and including 3.1.8.9 ) is vulnerable to unauthenticated arbitrary file upload . The root cause is insufficient validation of the attacker-controlled URL field within the 'temporaryFileUploads' parameter during form submission. An unauthenticat...

CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

CVE-2026-85097: Unrestricted Upload of File with Dangerous Type

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

PT-2026-107851

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10 Description The Bricksforge plugin for WordPress contains a flaw allowing unauthenticated attackers to upload and execute arbitrary PHP code on the server. The issue stems from insufficient validation of...

WordPress Bricksforge plugin <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin Bricksforge versions = 3.1.8.9...

VulnCheck KEV: CVE-2026-85097

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...