Bricksforge WordPress plugin CVE-2026-85097 exploited: unauthenticated file upload to RCE through form submissions. Which version fixes it and how do I check my site?

What it is: a critical (CVSS 9.8 to 10.0) unrestricted file upload flaw in Bricksforge, a commercial add-on for the Bricks Builder WordPress theme. Weak validation of uploaded file details in Bricksforge form submissions lets an unauthenticated attacker upload a file the server will run, which means code execution as the web server user. Patchstack saw automated attacks from dozens of IP addresses from October 7, 2026. Am I affected? Sites running Bricksforge 3.1.8.9 or earlier, especially if they use Bricksforge forms with file upload fields. How to check: WordPress admin > Plugins (or wp plugin list | grep -i bricksforge) and read the version. Fix: update to Bricksforge 3.1.8.10 or later on the 3.x line, or 4.0.1 or later on the 4.x line. Because it is a commercial plugin, updates come through your Bricksforge license; download it from your account if automatic updates aren't working. Interim mitigation: if you can't update right away, deactivate Bricksforge or remove file upload fields from its forms, and block PHP execution in wp-content/uploads (web server rule or a WAF rule). After updating, check for compromise: - Look in wp-content/uploads (and any Bricksforge upload folder) for .php, .phtml, .phar or other script files, and for recently modified files anywhere in the install (find . -newer wp-config.php -type f). - Review admin users for accounts you didn't create, and check for unknown plugins, mu-plugins and scheduled cron events. - Look in access logs for requests to unexpected files in uploads since early October. If you find a web shell: restore from a clean backup or reinstall WordPress core, themes and plugins from fresh copies, then change WordPress admin passwords, database credentials and the salts in wp-config.php. Sources: https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/ https://cybelangel.com/de/blog/cve-2026-85097-the-bricksforge-wordpress-exploitation/ https://www.esecurityplanet.com/de/cybersecurity-threats/cve-2026-85097-bricksforge-schwachstelle-was-websitebetreiber-wissen-muessen/