Patchstack says it saw exploitation attempts against the Bricksforge WordPress plugin starting October 7, targeting CVE-2026-85097, an unauthenticated file-upload flaw rated CVSS 10.0.
What Patchstack reported
According to the Patchstack advisory, versions 3.1.8.9 and earlier are affected, and 3.1.8.10 fixes the flaw. The bug allows an unauthenticated visitor to upload arbitrary files, which can lead to remote code execution. Patchstack’s telemetry recorded the first attempt at 21:47 UTC on October 7, and the advisory followed on October 8.
Patchstack counted 63 unique source IPs. The six most active accounted for about 46% of requests. One cluster of 44 IPs sent 56 identical requests within seconds, and another cluster of three IPs tried 25 extension and encoding variations against the same temporary file. In about 95% of captured requests the server-side path ended in .gif or .png, and most of those paired it with a PHP-related destination.
What defenders should do
Patchstack’s guidance is direct: “If you are a Bricksforge user, update to at least version 3.1.8.10.” Sites that cannot update immediately can use Patchstack’s RapidMitigate rule, which blocks the attempts at the traffic layer. Sites that ran a vulnerable version unprotected should review historical logs and look for unexpected PHP files in the plugin’s temporary upload directory and other uploads folders, including files matching login_admin_*.php.
Why it matters
The first recorded attempt came on October 7 and the advisory on October 8, so the attempts began before the public write-up. Patchstack says its mitigation rule was live before the first attack arrived. Sites without a virtual patch had no such cover, which is the argument behind our opinion that you should start the patch clock on release day, not advisory day. The same pattern appeared in our report on how Citrix patched a bug weeks after it was exploited.
Source: Patchstack
