Bricksforge flaw lets anyone run code on the server, no login needed

What happened

Bricksforge is a paid add-on for the Bricks visual builder. It adds forms, animations and other extras. Its Pro Forms upload handling had a flaw that let anyone, with no account, upload a PHP file and run it on the server.

The trick: upload a file that passes as an image but also contains PHP. Bricksforge checked the file type at upload, then later trusted the details the visitor sent with the form and saved the contents to a .php location. Requesting that file ran the attacker's code.

Patchstack rated it 10.0, the maximum. SecurityWeek reported 9.8.

Who is affected

• Any site running Bricksforge 3.1.8.9 or earlier.
• No login, special settings or user interaction is needed.
• Patchstack puts Bricksforge at roughly 6,000 active installations.

What to do

1. Update to 3.1.8.10, or 4.0.1 on the newer branch.
2. Look in /wp-content/uploads/bricksforge/tmp/ for any .php files. There should be none.
3. Check logs for requests to /wp-json/bricksforge/v1/form_submit, or admin-ajax.php with the bricksforge_form_submit action, carrying a temporaryFileUploads parameter.
4. If you find a stray PHP file, assume code ran on your server. Restore from a clean backup and rotate every credential.

Timeline

• Oct 7, 2026, 21:47 UTC: Patchstack records the first exploitation attempts.
• Oct 8, 2026: Public advisory. Bricksforge 4.0.1 released.
• Oct 12, 2026: SecurityWeek and The Hacker News report active exploitation. One analysis counts attacks from 63 IP addresses.

Sources

• The Hacker News
• SecurityWeek
• CybelAngel
• PlayCISO