CVE-2026-85097

9.8 CRITICAL

Published 2026-10-08 · Updated 2026-10-08

AI risk analysis

Summary: The Bricksforge plugin for WordPress allows unauthenticated attackers to upload and execute arbitrary PHP code by exploiting insufficient validation of the 'temporaryFileUploads' parameter.
Exploitability: Exploitation is moderately hard as it requires obtaining a valid nonce and crafting a specific file upload, but the lack of a patch means the vulnerability remains active.
Blast radius: If exploited, this vulnerability could result in full server compromise, allowing attackers to execute arbitrary code and potentially gain control over the affected WordPress site.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Bricksforge version 3.1.8.10 or later.

rcewebuploadphp

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.