A critical security flaw in the WordPress Bricksforge plugin is under active exploitation in the wild, according to Patchstack.
The vulnerability allows unauthenticated remote code execution through form submission handling.
Developers and administrators should review update statuses.
The issue affects versions of the plugin up to and including 3.1.8.9. Through this vulnerability, unknown parties can upload files and execute code remotely, effectively taking control of the website.
How is the attack carried out?
According to the researchers, the problem is due to a lack of form submission checks. Specifically, the attacks began to be recorded on October 7, 2026.
The perpetrators follow specific steps to exploit the gap:
- They receive a special temporary code from the system.
- They upload a file that looks like an image but hides code inside, bypassing initial checks.
- They submit a form where the path points to the image, but the file extension ultimately leads to the execution of the code.
To bypass security filters, the attacks use various variations in file extensions, case changes, and encoded characters. This activity has been recorded from dozens of different addresses on the internet, with some even making the majority of requests.
At the same time, researchers found that in other cases, additional security issues in other plugins were used to deliver malicious JavaScript code, which can secretly install plugins and create new administrator accounts.
What should administrators do?
The creators of Bricksforge have released updates since version 3.1.8.10 and recommend upgrading to the latest version immediately.
However, experts point out that a simple update does not remove a possible previous infection. Website owners are urged to check for any unknown administrators, examine server logs, and look for any suspicious files that may have been placed in temporary files folders.
Top comments (0)