Bricksforge Plugin up to 3.1.8.9 on WordPress temporaryFileUploads unrestricted upload

Summaryinfo

A vulnerability identified as critical has been detected in Bricksforge Plugin up to 3.1.8.9. This affects an unknown function. This manipulation of the argument temporaryFileUploads causes unrestricted upload. This vulnerability is handled as CVE-2026-85097. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in Bricksforge Plugin up to 3.1.8.9 and classified as critical. Affected by this vulnerability is some unknown functionality. The manipulation of the argument temporaryFileUploads with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

It is possible to read the advisory at wordfence.com. This vulnerability is known as CVE-2026-85097 since 09/03/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/08/2026). The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-94793). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Bricksforge Plugin

Version

• 3.1.8.0
• 3.1.8.1
• 3.1.8.2
• 3.1.8.3
• 3.1.8.4
• 3.1.8.5
• 3.1.8.6
• 3.1.8.7
• 3.1.8.8
• 3.1.8.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion