CVE-2026-85097: Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforgeregeneratenonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need authentication or user interaction. They can obtain a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot to the temporary upload directory, and then submit a crafted temporaryFileUploads parameter that causes the file to be treated as a PHP file.
Which installations are affected?
Bricksforge for WordPress versions up to and including 3.1.8.9 are affected. The provided data does not identify any configuration prerequisite beyond the vulnerable plugin being present.
What is the likely impact of successful exploitation?
Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary PHP code on the server. This can result in full compromise of the confidentiality, integrity, and availability of the affected WordPress environment.
How can I determine whether exploitation may have occurred?
Review the temporary upload directory for unexpected files, especially files involving GIF/PHP polyglots or files with PHP extensions. Also review form submissions and requests involving the temporaryFileUploads parameter and the bricksforge_regenerate_nonce AJAX endpoint.