Bricksforge WordPress Plugin (versions 3.1.8.9 and below)
A commercial add-on for the Bricks visual site builder that extends WordPress websites with features like custom forms, animations, an email designer, and custom admin pages. It is used by approximately 6,000 websites.
Root Cause
The plugin failed to validate or restrict uploaded file types before accepting them. No authentication check was in place to confirm who was making the request, meaning the vulnerability could be triggered by anyone on the internet.
Attack Vector
An attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a malicious PHP file attached. Because no authentication or file-type validation is enforced, the server accepts the file and stores it. The attacker then requests that file's URL, the server executes it, and the attacker gains full control of the site. Patchstack observed two automated attack clusters — one using 44 different IP addresses firing identical payloads, another testing 25 variations of PHP file extensions — suggesting organised, scripted exploitation.
Detection Notes
- Check server logs for POST requests to Bricksforge form endpoints containing unusual file extensions (.php, .phtml, .php5).
- Look for unfamiliar PHP files in WordPress upload directories (typically
/wp-content/uploads/). - Review your WordPress admin user list for any accounts you did not create.
Recommended Actions
- Update Bricksforge to version 3.1.8.10 immediately.
- Audit uploaded files in your WordPress installation for anything suspicious added after 7 October.
- Restrict direct PHP execution in your uploads directory via your server configuration or hosting control panel.