Bricksforge (Bricks) vulnerability: what to do today

If your website runs on Bricks Builder and has the Bricksforge plugin installed, this one is for you. And if you are not sure whether it does, it is also for you: you can find out in two minutes.

On 8 October 2026, Patchstack published an advisory about a flaw in Bricksforge, tracked as CVE-2026-85097. It lets a complete stranger, with no password, upload a PHP file to your server and run it. In security terms that is remote code execution: whoever manages it can do almost anything they like on your site.

Patchstack logged the first attack attempts on 7 October at 21:47 UTC. In other words, the flaw was being exploited before the public advisory existed.

Two clarifications before going on, because the headlines tend to blur them:

• The flaw is in Bricksforge, not in Bricks. Bricksforge is a separate plugin installed on top of the builder. Updating the Bricks theme does not fix it.
• The severity score depends on who is scoring. Patchstack gives it 10.0 out of 10. The NVD entry, which carries Wordfence’s data, says 9.8. In practice it makes no difference: it is critical and it is being exploited.

Which versions are affected

Bricksforge version	Status
3.1.8.9 and earlier	Vulnerable to CVE-2026-85097
3.1.8.10 and 4.0.0	Fix this flaw, according to the plugin’s own changelog
4.0.1 (8 Oct 2026)	Fixes a further security problem in Pro Forms file uploads
4.0.2 (13 Oct 2026)	Hardens several REST endpoints. The latest version listed in the changelog at the time of writing

My advice is to go straight to the latest version rather than stopping at 3.1.8.10. The changelog says of 4.0.1 that its fix affects “every site with Pro Forms active, even sites whose forms have no upload fields”. And the jump to 4.x is a big one, so it is worth testing first (more on that below).

How to tell whether your site uses Bricksforge

1. In the WordPress dashboard, go to Plugins > Installed Plugins and look for “Bricksforge”. Note the version.
2. If it is installed but deactivated, do not leave it there: either update it or delete it. An inactive plugin does not run, but it still sits on the server and gets forgotten.
3. If you are not sure your site uses Bricks, the active theme is listed under Appearance > Themes.

Do you need forms with file uploads to be exposed? Patchstack does not spell it out: it says the vulnerable code is in the Pro Forms module and that all versions up to 3.1.8.9 are affected. And the vendor, as we have seen, talks about every site with Pro Forms active. Until there is a better confirmation, treat having the plugin as being affected.

How the attack works (briefly)

It helps to know what to look for afterwards. According to Patchstack, the attack has four steps:

1. The attacker requests a security token (a nonce) from a public function of the plugin, without logging in.
2. They upload a GIF image that actually has PHP code hidden inside it. The plugin checks that it looks like an image and accepts it.
3. They submit a form where the file path points to that image, but the destination address ends in .php. The plugin does not validate that destination.
4. The server copies the contents into a PHP file. Simply visiting it is enough to run the code.

That is why the clues are PHP files in places where there should be none.

What to check if your version was vulnerable

Updating closes the door, but it does not throw out anyone who already got in. Patchstack says exactly that: if the site was not protected, review the server and the logs.

The specific clues Patchstack publishes:

• PHP files in /wp-content/uploads/bricksforge/tmp/.
• Files named login_admin_*.php in the uploads folder (one payload targeted /wp-content/uploads/2026/10/).
• Disguised extensions: .php5, .php7, .php8, .phtml, .pht, .phtm, .phps, or mixed capitals (.pHp).
• In the server logs, POST requests to /wp-json/bricksforge/v1/form_submit, or to admin-ajax.php with the action bricksforge_form_submit or bricksforge_regenerate_nonce.

General checks (not from Patchstack, but standard after any PHP upload):

• Any .php file inside wp-content/uploads. There should be no code there. Note that some plugins leave an almost empty index.php to prevent directory listing; that is usually harmless, but have a look.
• Administrator users you do not recognise under Users.
• Installed plugins you did not install.
• Recently modified files in the WordPress root and in wp-content.
• Scheduled tasks (cron) and security warnings in Search Console.

If you have SSH access, this command lists the PHP files in the uploads folder:

find wp-content/uploads -type f \( -iname "*.php*" -o -iname "*.phtml" -o -iname "*.pht" -o -iname "*.phps" \)

Patchstack describes the activity as automated, from 63 different IP addresses, and does not attribute it to a single actor. This is a mass campaign, not someone who picked you out. But it also means you do not need to be an interesting target to get a visit.

And one more thing: there is no way of knowing without looking. A site that “works normally” proves nothing; a web shell does not announce itself.

If you find something

Calmly, and in order. First, do not delete blindly: you would destroy the clues about how they got in.

1. Keep a copy of the site exactly as it is (files and database) and of the server logs.
2. Update Bricksforge to the latest version, or deactivate and delete it if you do not use it.
3. Change the credentials: the hosting password, the WordPress administrator passwords and the database keys. If the attacker ran code, they could have read wp-config.php. In addition, with version 4.0.2 the vendor recommends renewing any API keys stored in Bricksforge’s settings.
4. Review users, plugins and files using the list above.
5. Do not restore a backup blindly. If it dates from after 7 October, it may bring the backdoor back with it. Work out how long it has been inside.
6. Consider professional help if there are files you do not understand. A half-finished clean-up is worse than none: attackers often leave more than one way in.

What to do depending on your case

Your case	What to do today
You do not have Bricksforge	Nothing to do for this flaw. Check your other plugins
You have it and you are on 3.1.8.9 or earlier	Back up, update to the latest version and check the clues above. Top priority
You have it on 3.1.8.10 or 4.0.0	Update to the latest. This flaw is already fixed there, but still check the clues above if you do not know when you updated
You cannot update right now	Deactivate the plugin until you can. Patchstack mentions its own blocking rule (RapidMitigate) for its customers; a WAF can help, but it is no substitute for updating
You have suspicious files	Follow the “If you find something” list

About the update: Bricksforge moved from 3.x to 4.x. If you can, do it first on a test copy (staging), check that your forms, animations and templates are still fine, and then push it to production. If the site is a shop or takes enquiries, test a complete form submission. But do not delay the update for more than a day because of that: attacks are live.

What we know and what we don’t

• Confirmed: CVE-2026-85097, the affected versions, the fixed version, first attacks on 7 October, and the paths and files Patchstack publishes.
• Not listed in CISA’s KEV catalogue as of today (the list of exploited flaws kept by the US cybersecurity agency), going by its file of 23 October. That does not mean it is not being exploited: Patchstack does observe it.
• Unconfirmed: how many sites have actually been compromised. Patchstack speaks of blocked attempts, not successful hacks.
• We do not know what attackers do after uploading the file, beyond running code. The sources I could cross-check do not say.

So, what now

Open the plugin list, see whether Bricksforge appears and which version it is. If you have it: back up, update and look for PHP files in uploads. It takes ten minutes and removes the doubt.

If you find something odd and would rather someone else looked at it, at AGENCIA RSE we do WordPress malware removal: first we check what happened, then we clean up. There are also some free tests to check your site from the outside.

If you spot any outdated information, let us know and we will correct it.