Critical Severity
CVE-2026-85097
Published: Oct 25, 2026
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
# CVE-2026-85097 - Bricksforge WordPress Plugin Unauthenticated File Upload to RCE Toolkit
<p align="center">
<img src="https://img.shields.io/badge/CVE-2026--85097-red?style=for-the-badge&logo=common-vulnerabilities-and-exposures&logoColor=white" alt="CVE-2026-85097">
<img src="https://img.shields.io/badge/CVSS-10.0-critical?style=for-the-badge&logo=common-vulnerabilities-and-exposures&logoColor=white" alt="CVSS 10.0">
<img src="https://img.shields.io/badge/Active_Exploitation-Confirmed-blue?style=for-the-badge&logo=circle&logoColor=white" alt="Active Exploitation">
<img src="https://img.shields.io/badge/Python-3.6+-blue?style=for-the-badge&logo=python&logoColor=white" alt="Python 3.6+">
</p>
<p align="center">
<img src="https://img.shields.io/badge/Pre--Auth-File_Upload-orange?style=for-the-badge&logo=wordpress&logoColor=white" alt="Pre-Auth File Upload">
<img src="https://img.shields.io/badge/Polyglot-PNG_GIF-red?style=for-the-badge&logo=security&logoColor=white" alt="Polyglot">
<img src="https://img.shields.io/badge/Cross--Platform-blue?style=for-the-badge&logo=linux&logoColor=white" alt="Cross-Platform">
</p>
<h2 align="center">Bricksforge WordPress Plugin - Unauthenticated Arbitrary File Upload to Remote Code Execution</h2>
<p align="center">
<b>Exploit Toolkit and Safe Detection Scanner</b><br>
<i>For authorized security testing only.</i>
</p>
---
## [+] Vulnerability Overview
**CVE-2026-85097** is a critical **unauthenticated arbitrary file upload** vulnerability in the Bricksforge WordPress plugin (versions 3.1.8.9 and below). It allows remote attackers to bypass MIME validation and upload attacker-controlled PHP files to the uploads directory, resulting in **remote code execution** as the web server user.
### How it works
1. **Nonce Retrieval:** The `bricksforge_regenerate_nonce` AJAX action is registered with `wp_ajax_nopriv_`, allowing unauthenticated attackers to obtain a valid REST nonce.
2. **Po