Attackers are exploiting a critical unauthenticated file upload flaw in the Bricksforge WordPress plugin to run their own code on websites that have not been patched. A second campaign is using cross-site scripting bugs in Ninja Forms and WPC Product Bundles for WooCommerce to plant hidden administrator accounts that survive updating.
What happened
WordPress security firm Patchstack says it first recorded attempts to exploit CVE-2026-85097, a flaw in the Bricksforge plugin, at 21:47 UTC on 7 October 2026. SecurityWeek and The Hacker News reported the exploitation on 12 October. The bug lets someone who has never logged in upload a file of their choosing and then execute it, which means taking over the website.
Bricksforge is a commercial add-on for Bricks, a visual page builder for WordPress. It bolts on forms, animation effects, an email designer and additional admin screens. Patchstack puts its install base at around 6,000 websites. Every release up to 3.1.8.9 is vulnerable; 3.1.8.10 contains the fix. The Hacker News recommends going straight to the current release, 4.0.1.
Reported severity varies slightly. Patchstack’s own database entry and The Hacker News give CVE-2026-85097 the maximum CVSS score of 10.0, while SecurityWeek lists 9.8. Either way it is critical, and live exploitation matters more than the decimal point.
Exploitation of two other plugins is running in parallel. According to The Hacker News, which cites Patchstack, attackers are using stored cross-site scripting flaws in WPC Product Bundles for WooCommerce (CVE-2026-93836) and Ninja Forms (CVE-2026-94504), both rated 7.1. They use them to deliver a JavaScript payload that installs a backdoor plugin and creates rogue administrators. Ninja Forms is far more widely used than Bricksforge, so this strand potentially exposes many more sites.
The technical picture
The Bricksforge flaw is a classic case of trusting the client. Patchstack explains that the plugin does check a file’s MIME type when it first arrives in a temporary upload folder. When a form is submitted later, though, it accepts file metadata supplied by the browser without checking it again. A URL field inside the temporaryFileUploads parameter is not validated. An attacker can therefore pair a harmless-looking image that passed the first check with a destination that the server will treat as executable PHP.
Wordfence describes the use of a polyglot file, one that is both a valid GIF and valid PHP, to get through the initial inspection. Patchstack’s telemetry shows attackers trying a long list of alternate PHP extensions, mixed-case variants and URL-encoded forms to get past extension filters.
Patchstack observed 63 unique source IP addresses, with six of them responsible for about 46% of requests. In one cluster, 44 addresses fired 56 identical requests within seconds of each other. In another, three addresses cycled through 25 extension and encoding variations against a single temporary file. Patchstack reads this as automated activity using rotating proxies or distributed infrastructure, though it stresses the patterns alone do not tie it to one actor.
The Ninja Forms and WPC Product Bundles activity works differently. The injected script sits inside the site until a logged-in administrator views the affected content. It then uses that administrator’s session to install a malicious plugin, add a new admin account, set up further hidden persistence and report back to the attacker. Patchstack calls it a post-exploitation and persistence implant. The rogue administrator is hidden from the normal Users screen, and the backdoor includes a “magic” login URL that signs the holder in as the site’s oldest administrator, along with a file manager reachable without authentication.
Why it matters for UK organisations
WordPress runs a large share of British websites: small businesses, high-street retailers on WooCommerce, charities, membership bodies, schools, parish and town councils, and plenty of corporate marketing sites. Many are built by agencies, and patching often falls between the builder and the owner.
A compromised site is rarely the end of the matter. WordPress footholds are used to harvest form and order data, inject card skimmers, host phishing pages on a trusted domain and reach anything sharing the host’s credentials. Any personal data exposed through form entries or WooCommerce orders may create a reporting duty to the Information Commissioner’s Office under UK GDPR, typically within 72 hours of becoming aware of the breach.
Too many organisations still treat the website as an outsourced brochure. Cyber Essentials does not. Internet-facing services are in scope, and high-risk or critical updates are expected within 14 days of release.
Expert view
Two things stand out to me. The first is the gap between disclosure and exploitation, which on WordPress is often measured in days. Wordfence counted 2,073 new WordPress vulnerabilities between April and June 2026, alongside roughly 573,000 compromised sites. With that volume, nobody can patch on a monthly cycle and stay ahead.
The second, and more important, is the warning that updating Ninja Forms or WPC Product Bundles stops new infections but does not undo an existing one. In my experience, this is where organisations get caught out. They see a “you are up to date” banner and assume the incident is closed, while an invisible administrator and a backdoor plugin sit quietly in the database and the plugins directory. When we test WordPress estates, hidden admin accounts and stray files in upload folders are among the most common signs of an earlier, unnoticed compromise.
For developers, the Bricksforge bug is a lesson: validating once and trusting later is a design flaw. Check client-controlled values where they are used.
What to do now
- Inventory your plugins. List every WordPress site you own or pay someone to run, and record whether Bricksforge, Ninja Forms or WPC Product Bundles for WooCommerce is installed, including on staging and forgotten microsites.
- Patch immediately. Update Bricksforge to 3.1.8.10 or later (4.0.1 is current), Ninja Forms to 3.15.4 or later and WPC Product Bundles to 8.6.7 or later. (Cyber Essentials security update management). If you cannot update, disable the plugin until you can.
- Hunt for persistence. Query the users table directly rather than relying on the admin screen, and compare administrators with a known-good list. Check the must-use plugins folder and the plugins directory for anything unfamiliar.
- Check Bricksforge upload paths and logs. Look for unexpected PHP or oddly named files in the Bricksforge temporary upload folder, and review web logs for bursts of form submissions to the plugin’s endpoints since 7 October.
- Assume a compromise if you find one. Rebuild from a clean source, rotate all WordPress, database, hosting and API credentials, invalidate sessions and assess whether personal data was exposed for ICO purposes.
- Harden for next time. Block PHP execution in upload directories, put a web application firewall in front of the site, enforce multi-factor authentication for administrators (Cyber Essentials user access control) and make sure your contract with your web agency spells out who is responsible for patching.
Bottom line
This is a fast-moving, automated campaign against plugins that many UK organisations will not realise they run. Patch Bricksforge, Ninja Forms and WPC Product Bundles today, and then go looking for evidence that someone got in before you did. The update closes the door, but it will not evict anyone already inside.
