Affected Systems
Bricksforge WordPress plugin versions up to and including 3.1.8.9. Patched in version 3.1.8.10 (latest version 4.0.1 recommended). Affects WordPress sites using Bricksforge with Bricks visual builder.
Exploitation Status
Active exploitation confirmed since October 7, 2026. Patchstack observed automated attacks from 63 unique IPs targeting REST API and AJAX endpoints. Attackers using distributed infrastructure with rotating proxies, testing multiple PHP extension variations.
Business Impact
Unauthenticated remote code execution allows complete site takeover. Attackers can deploy web shells, create rogue admin accounts, exfiltrate sensitive data, and establish persistent backdoors. CVSS 10.0 reflects maximum severity: no authentication required, trivial to exploit via publicly documented four-step process. Immediate risk to all unpatched Bricksforge installations.
Urgency
🔴 Immediate
Recommended Actions
- Update Bricksforge plugin to version 4.0.1 immediately on all WordPress instances
- Audit web server logs for POST requests to /wp-json/bricksforge/v1/form_submit and /wp-admin/admin-ajax.php with action=bricksforge_form_submit containing temporaryFileUploads parameter since October 7, 2026
- Scan /wp-content/uploads/bricksforge/tmp/ directory for unexpected PHP files (.php, .php5, .php7, .phtml, .phar) and remove any unauthorized uploads
- Review WordPress admin accounts for unauthorized additions and check for suspicious plugins, especially those with file manager capabilities or magic login URLs
- Block or rate-limit access to Bricksforge endpoints at WAF/reverse proxy if immediate patching is not feasible, particularly from IPs 177.75.57.20, 23.97.62.146, 84.247.60.125, 38.154.185.97, 150.109.16.166, 153.75.90.146