CVE-2026-85097 Details
Description
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
A vulnerability allowing unauthenticated arbitrary file uploads has been identified in the Bricksforge plugin for WordPress, affecting versions through 3.1.8.9. The issue arises from inadequate validation of the 'temporaryFileUploads' parameter during form submissions. An unauthenticated attacker can exploit this by first obtaining a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint. The attacker can then upload a GIF/PHP polyglot file to the temporary upload directory, where MIME type validation is properly enforced. Afterward, the attacker can submit a form with a manipulated 'temporaryFileUploads' parameter that directs to the validated GIF file, but with an attacker-controlled URL ending in .php. This exploitation allows for the upload and execution of arbitrary PHP code on the server.
Users are advised to update the Bricksforge WordPress plugin to version 3.1.8.10 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bricksforge.io/version-changelog/ | [email protected] | Release NotesVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bricksforge | <= 3.1.8.9 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |