WordPress Bricksforge Plugin Unauthenticated File Upload Flaw

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Bricksforge plugin for WordPress contains a critical arbitrary file upload vulnerability (CVE-2026-85097, CVSS 9.8) affecting versions up to 3.1.8.9. The flaw stems from insufficient validation of user-controlled URL fields in the 'temporaryFileUploads' parameter, allowing unauthenticated attackers to bypass security controls. By first extracting a valid nonce through the bricksforge_regenerate_nonce AJAX endpoint, an attacker can upload malicious GIF/PHP polyglot files to temporary directories, potentially achieving remote code execution. This vulnerability affects any WordPress site running vulnerable Bricksforge versions, putting both site administrators and end-users at risk of compromise, data theft, and malware distribution.

Casky's Claude-powered platform, mapping 754 security skills to MITRE ATT&CK, would detect this attack chain across multiple techniques: Initial Access (TA0001) through the unauthenticated nonce extraction, Execution (TA0002) via PHP polyglot file execution, and Defense Evasion (TA0043) through MIME type bypass techniques. Practitioners using Casky would observe detections correlating suspicious AJAX calls to bricksforge_regenerate_nonce endpoints, followed by file upload attempts to temporary directories with suspicious file extensions. The platform's extended reasoning capabilities would flag the polyglot file pattern—a file masquerading as an image format while containing executable code—as a high-fidelity indicator of exploitation. Security teams would see findings highlighting the progression from reconnaissance (nonce gathering) through weaponization (polyglot creation) to execution, enabling faster incident response and proactive patching of affected WordPress installations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85097.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-85097

Casky has 447 skills that investigate the attack patterns behind CVE-2026-85097. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn