The Fake GIF That Opens a Root Shell: How a Perfect-10 WordPress Bug Went Wild in Hours

At 21:47 UTC on October 7, 2026, a sensor network run by the WordPress security company Patchstack recorded a probing pattern its analysts had not seen before: requests hitting an obscure AJAX endpoint on WordPress sites running the Bricksforge plugin, followed minutes later by form submissions carrying carefully crafted file metadata. Within days the pattern had a name and a number, CVE-2026-85097, and the worst possible severity score, a 10.0 on the CVSS scale. The attackers needed no username or password. A few crafted HTTP requests were enough to upload executable code and take a vulnerable site over.

Bricksforge is a commercial add-on for Bricks, the visual website builder that has become one of the most popular ways to design WordPress sites without writing code. The plugin's maker markets it as a Swiss Army knife for Bricks, bundling advanced forms, animations, and scrolling video sequences. Patchstack estimates roughly 6,000 sites run it, many of them marketing and client work built by agencies. Every one of those sites was a potential target, and the internet found out fast.

Checked at upload, trusted at submission

The bug is a classic security failure: validating input at one boundary and trusting it at the next. When a visitor uploads a file through a Bricksforge form, the plugin checks the file's MIME type, confirming it is really an image. But when the same form is later submitted, the plugin reads the file metadata the visitor's browser sends along, including a "url" field inside a parameter called temporaryFileUploads, and does not validate it. Patchstack's description is blunt: the plugin "validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends."

The exploit runs in four steps that The Hacker News reconstructed from Patchstack's technical report, published October 12. First, the attacker requests a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint, which requires no authentication. Second, they upload a polyglot file: a GIF whose bytes also contain valid PHP code. The image header satisfies the MIME validator, and the file lands in the temporary upload directory. Third, the attacker submits a form whose temporaryFileUploads entry pairs the validated server-side file path with a destination "url" ending in .php. Fourth, Bricksforge trusts the submitted metadata and writes the file's contents to the .php path. Requesting that file executes the hidden code.

The plugin checked the file's MIME type on upload, then trusted whatever metadata the client's browser sent at submission. That gap is the whole story.

Automated at scale: 44 IPs, 56 identical payloads, seconds apart

What turned a severe bug into an active incident was speed. Patchstack's telemetry shows two automated exploitation clusters. In the first, 44 IP addresses sent 56 requests carrying identical payloads within seconds. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file: .php5, .php7, .phtml, case tricks like .PHP and .pHp, and URL-encoded forms like .%70hp and .%2570%2568%2570. The extension and encoding roulette is designed to slip past server-side filters that only block the literal .php string.

In total, Patchstack logged 63 unique source addresses, with six of them accounting for roughly 46 percent of all requests. Patchstack declines to attribute the clusters to a single actor, noting only that both patterns point to automated exploitation over rotating proxies or distributed infrastructure. SOCRadar published a timeline showing the flaw's discovery, patch release, and in-the-wild activity all unfolding within days of each other.

A plugin with a rap sheet

CVE-2026-85097 is not Bricksforge's first serious problem. Wordfence's vulnerability database shows the plugin has accumulated multiple high-severity advisories this year, including earlier flaws enabling unauthenticated privilege escalation and information disclosure. The pattern suggests insufficient attention to input validation in the plugin's Pro Forms functionality: one component, many doors.

The vendor responded quickly by plugin-industry standards: version 3.1.8.10 closed the arbitrary file upload path, and a subsequent 4.0.1 release added further Pro Forms hardening. The problem is distribution: commercial plugins often require license keys or manual intervention to update, and many administrators lag days or weeks behind. Against an exploit chain that went from first probe to automated mass scanning in hours, that lag is the whole game. Similar patch sprints have become the rhythm of autumn, and they are not slowing down.

A second front: hijacking admins through their own browsers

Bricksforge is not the only WordPress battle this week. Patchstack reports that attackers are also abusing cross-site scripting flaws in two unrelated plugins, WPC Product Bundles for WooCommerce (CVE-2026-93836, CVSS 7.1) and Ninja Forms (CVE-2026-94504, CVSS 7.1), to deliver a JavaScript payload dubbed x.js. Once triggered inside the browser of a logged-in administrator, the payload abuses that authenticated session to install a malicious plugin, create an administrator account hidden from the Users screen, and set up a magic login URL authenticating its holder as the site's oldest administrator. The fixed versions are 8.6.7 and 3.15.4; updating stops new exploitation, but site owners must also query the database for hidden admins and inspect the must-use plugin directory.

Patching is not eviction

The distinction matters for Bricksforge too. Updating to 4.0.1 (or at minimum 3.1.8.10) closes the hole, but any site that was exposed before the update may already host a web shell. The recommended forensic sweep: audit requests to the form_submit endpoint and admin-ajax.php carrying the bricksforge_form_submit action and a temporaryFileUploads parameter, look for repeated form submissions, and scan the bricksforge temporary upload directory for unexpected PHP files. Where the timeline shows exposure before patching, the right assumption is compromise until evidence says otherwise.

The scale of the backdrop is worth stating plainly. Wordfence data cited this week counts 2,073 WordPress-related vulnerabilities published in the second quarter of 2026 alone, with high-threat flaws up 15.2 percent from the previous quarter, to 182. About 573,000 WordPress sites were compromised in that quarter. Against those numbers, a single perfect-10 bug looks less like an outlier and more like the sharp end of a trend: the platform that powers more than 40 percent of the web is under continuous, automated assault.

There is a structural point worth carrying into the next incident. WordPress's plugin ecosystem is its superpower: tens of thousands of extensions that let a small agency ship a sophisticated site in days. Each extension, though, is a fresh trust boundary, written by a different team. Core WordPress can be patched in hours; the long tail of commercial plugins updates on agency time. The same dynamic haunts enterprise VPN appliances, where a five-month-old patch still had not reached the networks ransomware crews were walking into this month. The vulnerability that hurts is rarely the one nobody found: it is the one that was found, fixed, and never applied, a pattern the ransomware economy has industrialized.

For site owners, the checklist is short: update Bricksforge to 4.0.1 today, audit the temporary upload directory and access logs, and if there is any sign the site was exposed before the patch, treat it as compromised. Visibility into the plugin catalog is no longer optional hygiene. As this week's events show, it is the security posture itself.