Description
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
Published: 2026-10-08
Score: 9.8 Critical
EPSS: 3.3% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Bricksforge versions up to 3.1.8.9 allow attackers to upload arbitrary files due to insufficient validation of the attacker‑controlled URL field in the 'temporaryFileUploads' parameter. This flaw enables unauthenticated upload of a PHP polyglot, resulting in arbitrary PHP code execution on the server and compromising the website's integrity and confidentiality.

Affected Systems

WordPress sites that have the Bricksforge plugin version 3.1.8.9 or earlier and that use the temporaryFileUploads feature are affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating critical severity, and an EPSS score of 3%, showing a low but non‑negligible likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated remote attacker who can access the site, obtain a nonce via the bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot file to the temporary upload directory, and then submit a forged temporaryFileUploads request that points to that file with a .php extension, enabling execution of arbitrary PHP code on the server.

Generated by OpenCVE AI on October 25, 2026 at 20:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Bricksforge release, version greater than 3.1.8.9, which contains the vendor fix.
  • If an update is not immediately possible, disable the Bricksforge plugin or the temporaryFileUploads endpoint to block the upload mechanism.
  • Configure the web server to prevent execution of files in the temporary upload directory, enforce strict MIME‑type checks, and ensure that uploaded files with .php extensions are not executable.

Generated by OpenCVE AI on October 25, 2026 at 20:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Bricksforge
Bricksforge bricksforge
Wordpress-extensions
Wordpress-extensions bricksforge
Vendors & Products Bricksforge
Bricksforge bricksforge
Wordpress-extensions
Wordpress-extensions bricksforge

Thu, 08 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Description The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
Title Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Bricksforge Bricksforge
Wordpress-extensions Bricksforge
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-08T14:24:41.018Z

Reserved: 2026-09-03T01:41:17.605Z

Link: CVE-2026-85097

cve-icon Vulnrichment

Updated: 2026-10-08T14:24:36.186Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T07:16:31.710

Modified: 2026-10-08T17:24:11.230

Link: CVE-2026-85097

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T20:45:13Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type