Loading story…
Attackers are exploiting CVE-2026-85097, a critical unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin, which is used by approximately 6,000 websites. The flaw affects versions 3.1.8.9 and earlier and can allow attackers to upload malicious files, execute PHP code and potentially take full control of vulnerable websites. Patchstack first observed exploitation attempts on October 7, 2026. Severity scores differ between reports: SecurityWeek cites a CVSS score of 9.8, while Patchstack reports 10.0.
Patchstack observed crafted upload metadata pairing an image file path with a PHP destination URL, alongside multiple extension-filter bypass variations. Two activity clusters involving distributed infrastructure or rotating proxies were consistent with automated exploitation, but the telemetry does not establish attribution to a single threat actor. Organizations should update immediately to version 3.1.8.10 or later and investigate suspicious form submissions and unexpected PHP files in upload directories. Patchstack reports deploying a traffic-layer mitigation before the first observed attack; administrators should still patch and check for evidence of compromise.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Bricksforge version 3.1.8.10 fixes CVE-2026-85097, an unauthenticated arbitrary file-upload vulnerability affecting versions 3.1.8.9 and earlier. Successful exploitation can enable remote PHP code execution and takeover of WordPress websites.
Patchstack detailed how attackers can obtain an unauthenticated nonce, upload a GIF/PHP polyglot, and manipulate client-supplied metadata to write executable PHP files. Its analysis identified 63 source IP addresses and provided detection indicators, while cautioning that the observed activity did not establish attribution to a single threat actor.
Patchstack deployed a RapidMitigate rule to block exploitation of CVE-2026-85097 at the traffic layer. The company stated that the protection was live before its first observed attack.
Bricksforge released version 4.0.1 with a Pro Forms upload security fix, according to the vendor changelog. The changelog urges users to update even when their active forms contain no upload fields.
Patchstack first observed exploitation attempts at 21:47:17 UTC, using crafted temporaryFileUploads metadata to pair an image file path with a PHP destination URL. The subsequent observed activity included a 44-IP cluster sending 56 identical requests and a three-IP cluster testing 25 extension and encoding variations, consistent with automated exploitation through distributed infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcesocradar.io
Open sourcesecurityweek.com
Open sourcepatchstack.com
Open sourcebricksforge.io
Open sourcewordfence.com
Open sourcecert.pa
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-0740**, a critical unauthenticated arbitrary file upload flaw in the **Ninja Forms File Uploads** premium add-on for WordPress that can lead to **remote code execution** and full site compromise. The vulnerability affects versions through `3.3.26` and stems from improper validation of file types and extensions in destination filenames, combined with missing filename sanitization that allows path traversal and placement of malicious PHP files in the webroot or other sensitive directories. Wordfence said it blocked more than **3,600** exploitation attempts in a 24-hour period and warned that attackers could use the bug to deploy web shells and take over vulnerable sites. Researcher **Sélim Lanouar** discovered the issue through Wordfence’s bug bounty program, and the vendor released a full fix in version `3.3.27` after an earlier partial remediation. Organizations using the add-on, which is deployed across more than **90,000** customer environments, have been urged to upgrade immediately.
Apr 7, 2026
Attackers are actively exploiting `CVE-2026-14894`, a critical CVSS 9.8 unauthenticated arbitrary-file-upload vulnerability in the WordPress **Super Forms – Drag & Drop Form Builder** plugin through version `6.3.313`. Insufficient file-type validation and a weak nonce mechanism in unauthenticated AJAX handlers let attackers obtain a valid nonce, upload executable PHP files, and potentially gain remote code execution and full control of affected sites. Roughly 13,000 active installations may be exposed. Exploitation was observed beginning July 14 and surged between August 18 and 25, with Wordfence blocking more than 250,000 attempts. Attackers have deployed a PHP webshell named `Mushr00w_upl.php`. Administrators should immediately upgrade to Super Forms `6.3.314`, released July 8, and investigate web roots and upload directories for unexpected PHP files and suspicious requests to the plugin's vulnerable AJAX endpoint.
Aug 13, 2026
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Apr 24, 2026