CVE-2026-85097
Overview
This vulnerability is an unauthenticated arbitrary file upload flaw in the Bricksforge WordPress plugin, caused by improper validation of the 'temporaryFileUploads' parameter during form submission. The root cause lies in the insufficient verification of the attacker-controlled URL field, allowing bypass of MIME type checks. The affected component is the temporary upload directory handling mechanism in Bricksforge versions up to and including 3.1.8.9.
Vulnerability Description
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
Impact
An unauthenticated attacker can execute arbitrary PHP code on the server by uploading and executing malicious files, resulting in full system compromise. This allows unauthorized access to sensitive data, modification or deletion of files, and potential lateral movement within the network. No authentication or user interaction is required, increasing the likelihood of exploitation in exposed environments. The business impact includes data breaches, service disruption, and loss of system integrity.
Solution
Upgrade the Bricksforge plugin to a version later than 3.1.8.9 where this vulnerability is patched, as detailed in the official changelog at https://bricksforge.io/version-changelog/. Wordfence provides an advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde?source=cve with additional mitigation guidance. Applying the vendor-released update promptly is the recommended remediation step.