Vulnerability report

CVE-2026-85097

Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload Arbitrary File Access

Bricksforge · 0 to <= 3.1.8.9

Watch CVE-2026-85097 Browse KEV feed
Severity
CVSS 9.8 · Critical
Confidence
—
Exploit status
PoC available
EPSS
0.3%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-85097 is an unauthenticated vulnerability affecting Bricksforge. The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is...

Is it exploited?

Previdian records an exploitation-related signal (poc available). This CVE has not been added as a known exploited vulnerability.

Who is affected?

Bricksforge 0 to <= 3.1.8.9.

What should we do?

Track for updates. Assess relevance to your asset inventory and enrichment workflows.

Overview

Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload Arbitrary File Access

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed.

Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

Bricksforge Affected
Bricksforge
Through 3.1.8.9
Published
08 Oct 2026
Exploitation date
—
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
None

CVE References

Exploitation evidence

Exploitation evidence for this CVE

These signals relate to exploitability. Previdian has not added this CVE as a known exploited vulnerability.

Proof of concept available

GitHub

Recorded 10 Oct 2026

Public scanner or PoC coverage increases practical exploitability.

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
0
0
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.8 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.3%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Unrestricted Upload of File with Dangerous Type CWE-434

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Wayang1337/CVE-2026-85097

github · Created 2026-10-10 04:51:32 UTC · 0 stars · AI assessment 90%

Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload

Timeline

From disclosure to today

  1. 04:51 UTC

    Public PoC available

    Public proof-of-concept code published

  2. 06:42 UTC

    CVE published

    Vulnerability disclosed publicly

  3. 01:41 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-85097

Free JSON includes basic KEV fields 
{
  "cve_id": "CVE-2026-85097",
  "confidence": null,
  "cvss_score": 9.8,
  "cvss_estimated": false,
  "epss_score": 0.00312,
  "exploit_status": {
    "exploited_in_the_wild": false,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}