Attackers Exploit Bricksforge CVE-2026-85097 RCE via Polyglot Uploads and Nonce Bypass

The flaw allows unauthenticated RCE because Bricksforge validates MIME type on initial GIF/PHP polyglot upload but later trusts the attacker-controlled 'url' field in temporaryFileUploads during form submission, writing the file contents to a .php path. Two distinct clusters appeared in telemetry: 44 IPs firing identical payloads within seconds and three IPs testing 25 extension variants including .php5, .phtml, and percent-encoded forms. This pattern matches automated scanning over rotating proxies rather than manual targeting.

WordPress plugin ecosystems have shown repeated file-upload validation gaps, from earlier Elementor and Contact Form 7 issues to nonce regeneration endpoints that leak valid tokens without authentication. Bricksforge's 'Swiss Army knife' feature set expanded the attack surface by exposing form handling and temporary upload directories without strict path canonicalization or server-side extension enforcement.

Patch rates remain low for niche visual-builder plugins; administrators relying on default WordPress update mechanisms face delayed deployment. Expect continued scanning for unpatched sites followed by web-shell deployment and credential harvesting within the next 72 hours.

Independent verification of the described request structure in public telemetry would confirm whether the observed activity matches the Patchstack and Wordfence technical descriptions rather than opportunistic noise.