Bricksforge WordPress flaw risks site takeover without login

The Bricksforge WordPress flaw is a remote code execution bug, which means an attacker on the other side of the internet can make your server run instructions of their choosing. It lives in the plugin’s form upload feature, the part that lets visitors attach a file to a contact or order form.

Patchstack rates it 10.0 on the CVSS scale, the industry’s standard severity score, and that is the very top of the scale. Wordfence, which keeps the official CVE record, gives it 9.8. Both agree on the basic point: no login is required, and the result can be a full takeover.

Bricksforge itself is a toolkit for Bricks that adds animations, advanced forms, dynamic content and admin tweaks. Because forms are one of its main selling points, a lot of sites using it have upload fields switched on. The developer’s own changelog goes further and says the problem touches every site where its Pro Forms feature is active, even if no single form asks for a file.

The trick exploits a gap between two moments. When a file is first uploaded, Bricksforge checks that it really is an image. When the form is then submitted, the plugin simply believes the file details the visitor’s browser sends back, including the web address where the file should end up.

Attackers use that trust in a few quick moves:

1. They ask a public Bricksforge function for a fresh security token, which it hands out to anyone without checking who is asking.
2. They upload a polyglot, a file that is a genuine GIF picture but also carries hidden PHP code. Because it is a real image, it passes the type check and sits in the plugin’s temporary folder.
3. They submit the form with doctored details: the file path still points at the innocent image, but the destination address ends in a PHP extension.
4. Bricksforge copies the image’s contents to that PHP location. When the attacker then visits the new file, the server runs the hidden code.

PHP is the programming language WordPress is written in, so once the server treats the file as PHP, the attacker’s code runs with the same reach as the site itself.

Patchstack logged attempts from 63 separate IP addresses, a mix of cloud servers, hosting companies and home internet connections. Six of those addresses sent roughly 46% of all the requests it saw.

Two patterns stood out. In one, 44 addresses fired off 56 identical requests within seconds of each other. In the other, just three addresses tried 25 different spellings and encodings of the PHP extension against the same temporary file, looking for one the plugin would accept. Patchstack says both point to automated tools running across many machines, but that this alone doesn’t prove one group is behind it.

In about 95% of the requests, the file path ended in .gif or .png while the destination pointed at a PHP file. To slip past simple filters, attackers swapped in rarer endings such as .phtml or .php5, mixed upper and lower case, or encoded the letters. Some tried to drop files with names starting with login_admin into the normal WordPress uploads folders rather than the temporary one.

Almost all of the traffic hit the plugin’s form endpoint on the WordPress REST API, the address apps use to talk to a site. A smaller number went through the older admin-ajax route instead.

Every Bricksforge release up to and including the ninth build of the 3.1.8 series is vulnerable. The tenth build of that series is the first fixed one, so anything from there on closes this hole.

The developer also shipped a separate security fix for Pro Forms uploads in its 4.0 release on October 8, and its release notes say forms with file fields keep working after the change. The simplest advice is to move to the newest version shown in your WordPress dashboard rather than stopping at the minimum fix.

Patchstack says it pushed a firewall rule that blocks the attack before the first real attempts arrived, and other security plugins may offer similar stopgaps. Treat those as a bridge until you can update, not a replacement for it.

Most people hit by this won’t be big companies. They’ll be a local shop, a portfolio site or a club page built by a freelancer a couple of years ago and rarely touched since. Those sites are exactly what automated scanners look for.

A takeover can mean spam pages showing up in Google under your name, visitors being sent to scam sites, or customer form submissions being read by a stranger. Your hosting company may also suspend a site that starts sending malware. If someone else looks after your site, send them the CVE number and ask for written confirmation of the Bricksforge version now installed.

Updating stops new break-ins, but it does nothing about an attacker who got in before you patched. If your site ran an old version after October 7, spend ten minutes on these checks, or ask your developer to:

• Look inside the Bricksforge temporary folder (inside wp-content, under uploads, bricksforge, tmp) for any file ending in .php or a similar variant. A real image folder should never contain one.
• Search the other upload folders for PHP files, especially ones with names beginning login_admin.
• Ask your host for access logs and look for repeated form submissions to the Bricksforge form endpoint that include a temporaryFileUploads field, followed by visits to newly created PHP files.
• Review your list of administrator accounts and remove anyone you don’t recognize, then change passwords for the remaining ones.

If you find anything suspicious, restoring from a clean backup taken before October 7 is often faster and safer than trying to pick a back door out by hand.

Two other plugin bugs being used at the same time

The same week, attackers were also abusing cross-site scripting bugs, where a booby-trapped script runs in an admin’s browser, in two unrelated plugins: WPC Product Bundles for WooCommerce (CVE-2026-93836) and Ninja Forms (CVE-2026-94504). Both are rated 7.1.

When a logged-in admin triggers the script, it quietly installs a malicious plugin, creates a new administrator hidden from the Users screen and adds a secret login link. The fixed versions are 8.6.7 for WPC Product Bundles and 3.15.4 for Ninja Forms. As with Bricksforge, updating blocks the attack but won’t remove an infection that’s already there, so check for hidden admins and odd plugins too.