Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85097— Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

Quick assessment

Affected
Bricksforge Bricksforge
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 中的 Bricksforge 插件在 3.1.8.9 及之前版本中存在未经身份验证的任意文件上传漏洞。该漏洞源于在表单提交过程中，对攻击者可控的 参数中的 URL 字段缺乏充分的验证。未经身份验证的攻击者首先可以通过 AJAX 端点获取一个有效的 nonce（一次性令牌），随后将一个 GIF/PHP 多模态文件（polyglot file）上传至临时上传目录，在该目录中 MIME 类型验证被正确执行。接着，攻击者可以提交一个表单，其 参数中包含精心构造的值：服务器端文件路径指向已验证的 GIF

CVSS 9.8 · Critical

Possible ATT&CK Techniques 1 AI

T1505.003 · Web Shell
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85097

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Bricksforge Bricksforge 0 ~ 3.1.8.9 -

II. Public POCs for CVE-2026-85097

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85097

请登录查看更多情报信息。

Vendor Pages for CVE-2026-85097 (1)

Other References for CVE-2026-85097 (1)

IV. Related Vulnerabilities

Same product: Bricksforge
Same vendor: Bricksforge
Same weakness: CWE-434

V. Comments for CVE-2026-85097

No comments yet

Leave a comment