CVE-2026-85097 in Bricksforge Plugin
Summary
by MITRE • 10/08/2026
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The Bricksforge plugin for WordPress contains a critical security vulnerability affecting versions up through 3.1.8.9, classified as an unauthenticated arbitrary file upload flaw. The root cause of this issue lies in insufficient validation logic within the handling of the temporaryFileUploads parameter during form submissions. While the initial stage of the attack involves uploading a file that passes MIME type verification, the subsequent processing step fails to adequately sanitize or validate the server-side path resolution against attacker-controlled input fields. This architectural weakness allows an adversary to bypass standard upload restrictions and achieve remote code execution on the targeted web server without requiring any form of authentication credentials.
The exploitation process begins with the attacker interacting with the bricksforge_regenerate_nonce AJAX endpoint, which is accessible to unauthenticated users. By invoking this endpoint, the attacker obtains a valid nonce value required for subsequent actions within the WordPress environment. With this token in hand, the adversary proceeds to upload a polyglot file, specifically crafted as both a GIF image and a PHP script. This dual-format file successfully passes the server-side MIME type validation checks because it contains valid header bytes for an image format while embedding executable code within its structure. The file is stored in the designated temporary upload directory where initial integrity checks are satisfied due to the correct identification of the file as a legitimate GIF document.
The critical failure occurs during the final submission phase when the attacker submits a form containing the crafted temporaryFileUploads parameter. In this payload, the server-side reference points to the previously uploaded and validated GIF polyglot file, but the attacker-controlled url field is manipulated to end with a .php extension. The application logic incorrectly assumes that because the underlying file passed initial validation, it can be executed or processed as indicated by the URL suffix provided in the request parameters. This logical flaw allows the web server to interpret and execute the PHP code embedded within the image file, effectively bypassing security controls designed to prevent script execution from upload directories.
From an operational impact perspective, this vulnerability grants unauthenticated attackers full remote code execution capabilities on the compromised system. Once the arbitrary PHP code is executed, the attacker can perform a wide range of malicious activities including but not limited to stealing sensitive database credentials, defacing the website, installing backdoors for persistent access, or pivoting to other systems within the internal network infrastructure. The lack of authentication requirement significantly lowers the barrier to entry for attackers, making this vulnerability highly exploitable by automated scanning tools and opportunistic threat actors targeting WordPress installations globally.
This flaw aligns with CWE-434 which describes unrestricted upload of file with dangerous type, as well as CWE-918 regarding server-side request forgery implications where user-controlled URLs influence server behavior. In terms of the MITRE ATT&CK framework, this vulnerability facilitates initial access through web application attacks and enables command execution via T1505.003 which covers Server Side Request Forgery leading to file inclusion or upload abuse. The combination of nonce manipulation and path traversal logic errors represents a sophisticated bypass technique that exploits trust in intermediate validation steps rather than direct input sanitization failures alone.
Mitigation strategies must prioritize immediate patching by upgrading the Bricksforge plugin to version 3.1.8.9 or later where these validation checks have been corrected. Administrators should also implement strict file upload restrictions at the web server level, such as configuring Apache or Nginx rules to prevent execution of PHP scripts within upload directories regardless of filename extensions. Additionally enabling Content Security Policy headers and utilizing Web Application Firewalls can provide additional layers of defense by blocking suspicious request patterns associated with polyglot uploads and nonce abuse attempts. Regular security audits focusing on form parameter validation logic are recommended to identify similar architectural weaknesses in other plugins or custom code components within the WordPress ecosystem.