{"id":"CVE-2026-85097","revision":"1a8cefd22c0e418d8873df9b3f3f1d72","records":[{"revision":"1a8cefd22c0e418d8873df9b3f3f1d72","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-85097","aliases":[],"title":"Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter","description":"The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.","state":0,"publishedAt":"2026-10-08T06:42:09.676+00:00","modifiedAt":"2026-10-08T14:24:41.018+00:00","affected":[{"ecosystem":"Vendor product","name":"Bricksforge","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Bricksforge\",\n                    \"product\": \"Bricksforge\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"3.1.8.9\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde?source=cve","https://bricksforge.io/version-changelog/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85097","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-85097","identifiers":["CVE-2026-85097"]},"retained":false,"historicalAffected":[]}],"coverage":[]}