lee1981 (@lee1981b) on X

What it is

CVE-2026-85097 is an unauthenticated file upload leading to PHP execution (CWE-434) in the Bricksforge WordPress plugin. CVSS v3.1 is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), assigned by Wordfence as CNA. NVD shows the same metric as Secondary, not as separate NIST scoring. Bricks Builder core is a different product and is not covered.

How it works

The CNA describes inconsistent trust in temporary upload metadata during form submission. An attacker-controlled URL field inside temporaryFileUploads is not kept consistent with the content validated earlier. MIME validation does run at the first stage, but later handling can still yield a PHP-executable file. The CNA also names the bricksforge_regenerate_nonce AJAX action, whose nonce is available without authentication. A nonce is request context, not authorisation. No crafted request or PoC is published.

Preconditions / Affected

• CNA range: through 3.1.8.9 inclusive. Wordfence's first patched version is 3.1.8.10.
• Separately, Bricksforge's 4.0.1 (8 October) fixes a Pro Forms upload-security issue. The vendor warning covers every site with Pro Forms active, even with no upload fields. No public source maps 4.0.1 to this CVE, so a 4.0.0 site with Pro Forms active still needs review.
• Version strings have four numeric components. Alphabetical sorting puts .10 before .9, and strict three-part parsers can reject both. Compare numerically and send suffixed releases to the vendor.
• Impact is bounded by the PHP/web service identity's permissions. Root is not a published outcome.
• Exploitation signals:
• CISA KEV: no match (catalogue 2026.10.08).
• EPSS (9 October): 0.312%, percentile 22.1%.
• SSVC (8 October): exploitation none, automatable yes, technical impact total.
• No active campaign was independently established.

What to do

1. Inventory the exact Bricksforge version, activation, Pro Forms state and reachability for every serving copy. Include staging, multisite, backend copies and restorable images.
2. Preserve CDN/WAF, proxy and origin logs before they expire. Form Submissions logging exists only if the optional feature is enabled.
3. Update to 3.1.8.10 or later on the 3.x branch. On 4.x, follow vendor guidance and move to 4.0.1 or later. Verify the running version on every node, reload PHP or caches as applicable, and test form health.
4. If patching is delayed, restrict the workflow or isolate the site through the hosting runbook. Hiding a field, adding CAPTCHA or changing a nonce is not a fix.
5. Disable PHP execution in upload storage as defence in depth, after checking the actual handlers and aliases.
6. For compromise review, correlate request → unexpected file (new PHP files, name/content mismatch) → PHP-FPM or EDR evidence of handling → unauthorised effect. Do not request or execute a suspect file.
7. WP-CLI's plugin list can export name, status and version as JSON. On suspected compromise, prefer an acquired inventory, because bootstrapping WordPress runs site code.

Escalate to IR only on corroborated unauthorised execution or effects. A vulnerable version is exposure, and a filename or HTTP 200 alone is not compromise.

Caveats

• No verified CVE-specific IOCs, filenames, hashes or universal upload path exist. The temporaryFileUploads parameter and nonce action also appear in legitimate requests.
• Core checksum verification does not cover Bricksforge or uploads. Plugin checksums likely lack a reference for this commercial plugin.
• The SOC trail (C01–C06) is CyberForge analysis, not vendor-tested detection. No live site was tested.
• Patching does not remove earlier files, accounts or changes. An empty search is bounded by sources, interval and log health.
• NVD's "Deferred" and "Not Scheduled" labels are workflow states, not a retraction.