An unauthenticated upload flaw
On October 7, 2026, Patchstack published an alert for CVE-2026-85097 in the Pro Forms module of the Bricksforge WordPress plugin. Validation of the URL field associated with temporary uploads was insufficient to prevent an arbitrary file from being placed on a site. According to the published technical details, an unauthenticated attacker could reach PHP code execution.
Affected versions and fix
Patchstack says versions through 3.1.8.9 are affected and version 3.1.8.10 fixes the issue. Site owners should check the version actually installed, including when an agency manages Bricksforge. The plugin notice and NVD describe the mechanism; consult those references before planning an update to a critical site.
What observed exploitation means
Patchstack reports observing attempts starting October 7. SocRadar relayed the observation and described the technical scenario, but campaign telemetry does not show that every vulnerable installation was targeted. Finding an affected release on an exposed site warrants a check, not an automatic declaration of compromise.
Actions for web teams
Update Bricksforge to 3.1.8.10 or later. Review access logs around form submission routes and look for recent, unexplained PHP files in upload directories. Check administrator accounts and recent changes. If you find signs of unauthorised execution, preserve logs and have a specialist investigate before cleaning the site.
The connection with Soclyde
A WordPress compromise can expose accounts and secrets in its environment, but a password vault does not fix a plugin flaw. Soclyde helps teams organise credentials they use for services; patching, monitoring and incident response must happen in the WordPress environment.
Key points
Identify Bricksforge installations, apply the fixed release and look for concrete signs of unusual activity. For credentials reused across services, our guide to strong unique passwords explains a complementary practice.
