Bricksforge CVE-2026-85097: CVSS 10.0 upload flaw enables RCE

A CVSS 10.0 unauthenticated file upload in the Bricksforge WordPress plugin lets attackers write a PHP file and execute code. Versions 3.1.8.9 and earlier are affected; the fix is 3.1.8.10, released October 8, 2026, with extra hardening in Pro Forms 4.0.1. Patchstack recorded exploitation attempts from October 7, and a public exploit toolkit exists.

• CVSS 10.0 flaw lets an uploaded file land at a .php path and execute
• Bricksforge 3.1.8.9 and earlier affected; fixed in 3.1.8.10 and Pro Forms 4.0.1
• Patchstack logged exploitation attempts starting October 7, 2026
• Attackers tried .php5, .phtml and double URL-encoded suffixes