Bricksforge Flaw Under Attack on WordPress: Update Now

Since October 7, 2026, automated attacks have targeted WordPress sites running Bricksforge, a paid add-on for the Bricks page builder. The flaw, CVE-2026-85097, lets anyone upload a file and run code on the server without logging in. It affects version 3.1.8.9 and earlier. If you run it, update today.

What we know

The flaw: according to the CVE record published on October 8, the Bricksforge form handler does not properly validate a field attached to uploaded files. An attacker with no account can drop a PHP file on the server and run it.
Affected versions: up to and including 3.1.8.9, according to Patchstack and the CVE record.
Severity: Patchstack scores it 10.0 out of 10. The CVE record, as mirrored by Spain's INCIBE-CERT, gives it 9.8 and rates it critical. Both sit at the top of the scale.
Attacks so far: Patchstack saw the first attempt on October 7 at 21:47 UTC. It counted 63 distinct IP addresses, with six of them sending about 46% of the requests, and reads this as automated exploitation rather than a single actor.
The fix: Patchstack says version 3.1.8.10 closes the hole. The vendor's changelog has no such entry. It lists version 4.0.1, dated October 8, with a security fix for file uploads in Pro Forms. The vendor says the issue affects every site with Pro Forms active, even without upload fields, and that full details will follow once disclosure is complete.
Who reported it: Patchstack published its analysis on October 8. The Hacker News covered it on October 12 and also cited a Wordfence advisory.

What changes and what doesn't

The bug is in Bricksforge, not in WordPress or Bricks itself. If Bricksforge is not installed, this does not affect you.

If it is installed, you are exposed whether or not your forms accept file uploads: the vendor says having Pro Forms active is enough. Because the attacks are automated, a small, low-traffic site is not safer.

The minimum safe version is unclear. Patchstack names 3.1.8.10, while the vendor only documents 4.0.1. Until that is cleared up, 4.0.1 is the only release the vendor itself lists as fixed.

A site compromised this way can end up serving spam pages or redirects that Google picks up, and that can hurt search visibility even after the hole is closed.

How to tell if it affects you

Check whether you have it. In the WordPress dashboard, open Plugins, find Bricksforge and note the version under its name.
On 3.1.8.9 or older, update now. The safest target is 4.0.1. If you are on the 3.x branch and worried about the jump, take a backup and test on a staging copy first: version 4.0.0 rebuilt several parts of the add-on, per its changelog.
Can't update today? Deactivate Bricksforge, or at least Pro Forms, until you can. Patchstack offers a protection rule for this CVE to its customers.
Left unpatched since October 7? Check the site. Look for .php files in the WordPress uploads folder, where they should not exist. Review your user list for administrators you don't recognize and change the passwords of the ones you do.
On shared hosting, ask your provider: "Can you check for new PHP files in my WordPress uploads and unusual requests to the Bricksforge form handler since October 7?"
If you find something, don't just delete it. Restore a backup from before October 7, update before bringing the site back, and check the Security issues report in Google Search Console.

Sources

Updates: this article will note if the vendor publishes the flaw details or confirms 3.1.8.10 as a fixed release.