DEV Community

Anoymask
Anoymask

Posted on

Bricksforge CVE-2026-85097: Unauthenticated RCE Attempted via GIF/PHP Polyglot

#security #threatintel

1. Basic Information

2. Executive Summary

Attackers acquire a public nonce, temporarily upload a GIF/PHP polyglot, and target arbitrary PHP execution through a form submission that mismatches the image path and the PHP URL. Automated active exploitation attempts from 63 IPs have been observed.

3. Attack Flow

Vulnerability Execution Steps and Observed Exploitation Requests

Below are the vulnerability execution steps described by Patchstack. Actual observations are primarily crafted form submission requests and do not confirm successful file creation or PHP execution on individual sites.

  1. Obtain a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint.
  2. Place a GIF/PHP polyglot containing PHP code into the Bricksforge temporary upload directory.
  3. Send temporaryFileUploads with mismatched image file paths and PHP destination URLs to /wp-json/bricksforge/v1/form_submit or admin-ajax.php.
  4. The plugin trusts client-supplied metadata and writes the contents to the PHP path, and when the attacker requests the file, the embedded PHP executes.
  5. If successful, attackers can proceed to webshells, content modification, sensitive data read, and persistence.

4. Attacker Position and Execution Location

  • A remote unauthenticated attacker with network reachability to the WordPress site.

5. Victim and Administrator Perspective

  • Users: Normal site browsing may show no changes. If defacement or redirection occurs, it will appear to users as well.
  • Administrators: Appears as nonce retrieval, form_submit, temporaryFileUploads, new PHP files in uploads, and subsequent HTTP access.

6. Success and Failure Conditions

Success Conditions

  • Bricksforge version 3.1.8.9 or earlier is active, and the target endpoint is reachable from the Internet.
  • The polyglot upload and client-supplied URL metadata are accepted, and the PHP file is placed in a location executable by the web server.

Failure Conditions and Mitigations

  • Update to version 3.1.8.10 or later.
  • Disable PHP execution in the uploads directory and block exploit patterns with a WAF.

7. Impact upon Success

  • Arbitrary PHP code execution with WordPress process privileges.
  • Webshell installation, site defacement, access to credentials and database information, and persistence.

8. Observable Logs

The following are candidate telemetry items for internal investigation. Differentiate between facts observed in public intelligence and telemetry to be verified within your organization.

  • Email: No email vectors specific to this incident have been confirmed.
  • Proxy / SWG / DNS: Check for bricksforge_regenerate_nonce, /wp-json/bricksforge/v1/form_submit, bricksforge_form_submit, temporaryFileUploads, and encoded PHP extensions.
  • Endpoint / EDR: Check for new PHP/polyglot files in /wp-content/uploads/bricksforge/tmp/ and regular upload directories, as well as child processes of the web server process.
  • Identity / IdP: Check for unusual logins, sessions, and credential modifications.
  • SaaS / Cloud: Check audit logs and change histories of related SaaS and cloud environments.
  • Network: Check for distributed requests from 63 source IPs, follow-up access to new PHP files, and unusual egress from the web server.

9. Attack Success Determination

Confirmed in Public Information

  • Exploit Attempts Observed (Success Unconfirmed): Patchstack observed exploit requests, but has not published successful PHP execution or subsequent compromise on individual sites.

Internal Determination Criteria

  • Correlate requests, responses, processes, authentication, data access, and external transmission chronologically to separate contact from success.
  • Do not determine success based solely on a single alert not present in public information.

10. Investigation Playbook

  • Investigation Starting Point: Start from CVE-2026-85097 alerts, temporaryFileUploads to Bricksforge endpoints, and PHP files in uploads.
  • Initial Verification: Verify the chronological order of plugin versions, endpoint exposure, nonce retrieval, uploads, form_submit, and new PHP access.
  • Endpoint / Server Investigation: Preserve WordPress root, uploads, temporary directories, web server processes, cron jobs, admin users, and plugin modifications.
  • Authentication / Cloud Investigation: Check for unusual usage of WordPress admin, hosting control panels, databases, and cloud credentials.
  • Subsequent Operations: Track webshell commands, additional payloads, redirections, database access, and external transmission.
  • Containment: Put the site in maintenance mode or isolate the network, update to version 3.1.8.10 or later, isolate unknown PHP files, and rotate credentials.
  • Determination Categories: Distinguish between contact, execution, successful authentication, data access, and subsequent compromise.

11. Defense and Detection Ideas

  • Single Event: Detect requests in temporaryFileUploads where the image path and PHP destination URL do not match, or where encoded/mixed-case PHP extensions are used.
  • Time-Series Correlation: Correlate nonce retrieval -> polyglot upload -> form_submit -> new PHP GET -> web server child process.
  • Threat Hunting: Search for login_admin_*.php, PHP files in uploads, combinations of .gif/.png and PHP URLs, and past access from the 63 source IPs.
  • Log Limitations: WAFs alone cannot confirm server-side file creation and execution success, making file integrity and process telemetry necessary.
  • Priority Mitigations: Update to 3.1.8.10, prohibit PHP execution in uploads, deploy WAF rules, and implement file integrity monitoring.

12. Facts / Inference / Hypothesis

Facts

  • Patchstack observed active exploitation attempts of CVE-2026-85097 starting from October 7, 2026, at 21:47 UTC.
  • A valid nonce can be obtained at the unauthenticated bricksforge_regenerate_nonce endpoint.
  • Attackers upload a GIF/PHP polyglot to a temporary directory and combine an image path with a PHP-related destination URL via temporaryFileUploads.
  • In 95% of observed requests, the server-side path extension was .gif or .png, many of which were combined with destination URLs carrying PHP-related extensions.
  • Patchstack recorded 63 source IPs, identifying a cluster of 44 IPs sending the exact same payload within seconds and a cluster of 3 IPs testing 25 different extensions/encodings.
  • Affected versions are 3.1.8.9 and earlier, and the patched version is 3.1.8.10.
  • Public intelligence confirms exploit requests, but has not confirmed successful webshell execution or data theft on individual sites.

Inference

  • Distributed sources and extension variations do not indicate attribution to a single actor, but are consistent with automated scanning and exploitation infrastructure.
  • Without correlating PHP file creation in upload directories with subsequent HTTP access, attempts cannot be distinguished from code execution.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "14. Open Questions and Additional Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Pre-authentication file upload and RCE attempts targeting an Internet-facing WordPress form endpoint have been observed.

14. Open Questions and Additional Investigation

  • The number of sites where observed requests actually succeeded in PHP execution or webshell installation.
  • Attacker attribution, final payloads, and the presence of information theft or lateral movement.

15. Impact on SOCs and Organizations

Organizations operating Bricksforge should immediately check for its usage and version, and update to 3.1.8.10 or later. Web access logs and upload directories must be reviewed retroactively, prioritizing investigations into mismatches between image paths and PHP URLs, login_admin_*.php files, and access to new PHP files.

16. Summary by Target Audience

  • For SOCs: Correlate nonce retrieval -> polyglot upload -> form_submit -> new PHP access to distinguish between attempts and successful execution.
  • For Administrators: Update Bricksforge to version 3.1.8.10 or later and prohibit PHP execution in the uploads directory.
  • For Users: No action is required by regular users. If instructions are provided by administrators, follow procedures such as password changes.

Top comments (0)