cve-2026-85097
CRITICAL CVSS 9.8 vulncheck_kevThe Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
- Published
- 2026-10-07 00:00 UTC
- Last Modified
- 2026-10-07
CVSS details not available.
No product information available.
No references available.
No linked vulnerabilities found.
{
"cvss": 9.8,
"datePublished": "2026-10-07T00:00:00Z",
"dateUpdated": "2026-10-07T00:00:00Z",
"description": "The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.",
"dueDate": "",
"id": "CVE-2026-85097",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Unknown",
"product": "bricksforge",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "CRITICAL",
"source": "vulncheck_kev",
"title": "bricksforge bricksforge Unrestricted Upload of File with Dangerous Type",
"vendor": "bricksforge"
}