CVE-2026-85097: Bricksforge WordPress Plugin Actively Exploited — Detection and Remediation Guide

---
title: Suspicious Requests Targeting Bricksforge WordPress Plugin
description: Detects reconnaissance and exploitation attempts against the Bricksforge WordPress plugin, associated with CVE-2026-85097 in-the-wild exploitation.
references:
  - https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/
author: Security Arsenal
date: 2026/04/06
id: 3f8a1c92-7b44-4e5d-9a21-c6d8e2f5a7b3
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wp-content/plugins/bricksforge/'
  selection_payload:
    cs-uri-query|contains:
      - 'base64_decode'
      - 'eval('
      - 'assert('
      - 'system('
      - 'shell_exec'
      - 'php://input'
      - '../'
      - 'cmd='
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate plugin AJAX calls should be reviewed; encoded payloads in query strings against this plugin path are rare in normal operation
level: high
---
title: WordPress AJAX or REST Endpoint Exploitation Payload Patterns
description: Detects POST requests to WordPress admin-ajax.php or REST API routes containing PHP code execution or file manipulation payloads, consistent with WordPress plugin takeover attacks such as CVE-2026-85097.
references:
  - https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/
author: Security Arsenal
date: 2026/04/06
id: 9c2e5d71-4a68-4f3b-b817-1d9f4a6c8e02
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/'
  selection_method:
    cs-method: 'POST'
  selection_payload:
    cs-uri-query|contains:
      - 'eval('
      - 'base64_decode'
      - 'file_put_contents'
      - 'move_uploaded_file'
      - 'wp_insert_user'
      - 'add_action'
      - '%3C%3Fphp'
      - '<?php'
  condition: selection_endpoint and selection_method and selection_payload
falsepositives:
  - Some plugin update or form handlers use POST to these endpoints; payload strings are the discriminator
level: high
---
title: PHP Webshell Dropped in WordPress Uploads Directory
description: Detects creation of PHP files in WordPress uploads directories, a hallmark of webshell deployment following plugin exploitation such as CVE-2026-85097.
references:
  - https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/
author: Security Arsenal
date: 2026/04/06
id: 5b1d7e34-8f29-4c6a-a543-2e8b9d1f7c40
status: experimental
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_creation
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
falsepositives:
  - Rare; legitimate media uploads are not PHP files. Some migration/backup tooling may write PHP into uploads — whitelist known tooling
level: critical

// Hunt 1: Reconnaissance and exploitation attempts against Bricksforge (CVE-2026-85097)
let SuspiciousPayloads = dynamic(["base64_decode", "eval(", "assert(", "system(", "shell_exec", "file_put_contents", "<?php", "php://input", "../", "cmd="]);
let BricksforgePath = "/wp-content/plugins/bricksforge/";
union isfuzzy=true
    (W3CIISLog
     | where csUriStem has BricksforgePath or (csUriStem has_any ("/wp-admin/admin-ajax.php", "/wp-json/") and csMethod == "POST")
     | where csUriQuery has_any (SuspiciousPayloads)
     | project TimeGenerated, cIP, sIP, csMethod, csUriStem, csUriQuery, scStatus, csUserAgent, SourceTable="W3CIISLog"),
    (CommonSecurityLog
     | where RequestURL has BricksforgePath or (RequestURL has_any ("admin-ajax.php", "/wp-json/") and RequestMethod == "POST")
     | where RequestURL has_any (SuspiciousPayloads)
     | project TimeGenerated, cIP=SourceIP, sIP=DestinationIP, csMethod=RequestMethod, csUriStem=RequestURL, csUriQuery="", scStatus="", csUserAgent=RequestClientApplication, SourceTable="CommonSecurityLog")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Requests=count(), DistinctURIs=dcount(csUriStem) by cIP, csUserAgent, SourceTable
| order by Requests desc;

// Hunt 2: Webshell drops and suspicious child processes from web server workers on WordPress hosts
DeviceFileEvents
| where FolderPath has "wp-content/uploads" and FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256
| join kind=leftouter (
    DeviceProcessEvents
    | where InitiatingProcessFileName has_any ("php", "php-fpm", "httpd", "apache2", "nginx", "w3wp.exe", "php-cgi.exe")
    | where FileName has_any ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "perl", "cmd.exe", "powershell.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
) on DeviceName
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

-- Hunt: Bricksforge CVE-2026-85097 post-exploitation artifacts on WordPress hosts
-- 1) PHP files recently written into uploads (webshell indicator)
LET webshells = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="/var/www/**/wp-content/uploads/**/*.php")
WHERE Mtime > now() - 1209600  -- last 14 days, tune to your patch window

-- 2) Suspicious child processes spawned by web server / PHP workers
LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(sh|bash|dash|curl|wget|nc|ncat|socat|python|perl)'
  AND getMember(item=getItem(field='Pid', member=Pid), field='Ppid')  -- keep structure explicit
  AND Exe =~ '(?i)(bin/(sh|bash)|bin/(curl|wget)|bin/(nc|ncat))'

-- 3) Outbound connections held by web server/PHP processes (webshell C2 / reverse shells)
LET websrv_net = SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)(php-fpm|php|apache2|httpd|nginx)'
  AND Status =~ '(?i)ESTABLISHED'
  AND NOT RemotePort in (80, 443, 3306, 6379, 11211)  -- exclude normal app/db/cache traffic

SELECT * FROM webshells
UNION ALL SELECT * FROM suspicious_procs
UNION ALL SELECT * FROM websrv_net

#!/bin/bash
# CVE-2026-85097 - Bricksforge exposure and compromise verification script
# Run as root or with sudo on each WordPress host. Adjust WP_ROOT as needed.

WP_ROOT="/var/www/html"
echo "=== [1] Bricksforge plugin presence and version ==="
if [ -d "$WP_ROOT/wp-content/plugins/bricksforge" ]; then
    echo "[!] Bricksforge IS installed. Version info:"
    grep -i "Version:" "$WP_ROOT/wp-content/plugins/bricksforge/bricksforge.php" 2>/dev/null || echo "    Main plugin file not found at expected path"
    grep -i "Stable tag:" "$WP_ROOT/wp-content/plugins/bricksforge/readme.txt" 2>/dev/null
else
    echo "[OK] Bricksforge plugin directory not found under $WP_ROOT"
fi

echo ""
echo "=== [2] PHP files inside uploads (webshell indicator) ==="
find "$WP_ROOT/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" -o -name "*.php5" -o -name "*.php7" \) -printf "%T+ %p\n" 2>/dev/null | sort -r | head -50

echo ""
echo "=== [3] PHP files modified in the last 14 days site-wide ==="
find "$WP_ROOT" -type f -name "*.php" -mtime -14 -printf "%T+ %p\n" 2>/dev/null | sort -r | head -80

echo ""
echo "=== [4] Suspicious strings in web root (webshell markers) ==="
grep -rlE "(eval\(base64_decode|assert\(\$_|system\(\$_(GET|POST|REQUEST)|shell_exec\(\$_|passthru\(\$_)" "$WP_ROOT" 2>/dev/null | head -30

echo ""
echo "=== [5] .htaccess integrity (redirect malware check) ==="
find "$WP_ROOT" -name ".htaccess" -mtime -30 -printf "%T+ %p\n" 2>/dev/null

echo ""
echo "=== [6] Unexpected established connections from web/PHP processes ==="
ss -tnp 2>/dev/null | grep -E "php-fpm|apache2|httpd|nginx" | grep -vE ":(80|443|3306|6379|11211)\s" | head -30

echo ""
echo "=== [7] Web server processes spawning shells/tools ==="
ps -eo pid,ppid,user,comm,args --forest 2>/dev/null | grep -E "(php-fpm|apache2|httpd|nginx)" -A 2 | grep -E "(sh|bash|curl|wget|nc|python|perl)" | head -20

echo ""
echo "=== Review complete. Any hits in sections 2-4 and 6-7 warrant IR escalation. ==="