Bricksforge is an add-on for the Bricks Builder theme that adds forms, animations and dynamic data. In October 2026 security researchers reported that a critical flaw in the plugin, CVE-2026-85097, was being exploited on real websites. The severity score is 10 out of 10, the highest possible.
What the flaw allowed
The problem sits in the plugin’s form handling. An attacker did not need an account: by sending specially crafted form submissions, they could get a file disguised as an image saved as an executable PHP file on the server. Once a PHP file runs, the attacker effectively controls the website. Patchstack first saw attacks on October 7, 2026, from 63 different IP addresses, and most requests targeted the plugin’s form-submit endpoint.
Affected and fixed versions
- Affected: Bricksforge up to and including version 3.1.8.9.
- Fixed: version 3.1.8.10 and later. The vendor also shipped a Pro Forms upload security fix in 4.0.1 on October 8.
What to do
- Update Bricksforge to the latest version right away. If you cannot, deactivate the plugin until you can.
- Look inside the uploads folder, especially the Bricksforge temporary folder, for PHP files. Images folders should never contain .php files.
- Check the administrator list for users you do not recognise and review recently installed plugins.
- Review server logs for many POST requests to the form endpoint around and after October 7.
- If you find signs of compromise, follow our recovery steps instead of only deleting the bad file.
The lesson goes beyond one plugin. Form and file-upload features are a favourite target, so any plugin that accepts files from visitors deserves extra care and fast updates.
Frequently asked questions
I do not use Bricksforge. Do I need to worry?
Not about this specific flaw. But the same kind of bug appears in many plugins, so the habits matter more: keep everything updated and remove what you do not use.
How do I know if the update was applied?
Open Plugins in the WordPress admin and read the version number under Bricksforge. It must be 3.1.8.10 or higher.
Is deleting the suspicious file enough?
Usually not. Attackers often leave several backdoors and may create admin accounts, so a full check is needed.
Read next
- My WordPress Site Was Hacked: What to Do Step by Step
- How to Check a WordPress Plugin Before You Install It
- WordPress Plugin and Core Vulnerabilities in Q3 2026: What Was Exploited
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
