CVE-2026-85097

{
  "etk_id": "ETK-2026-948",
  "cve_id": "CVE-2026-85097",
  "display_id": "CVE-2026-85097",
  "ghsa_id": "GHSA-jfvp-gc8p-45gp",
  "euvd_id": "EUVD-2026-94793",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file upload in Bricksforge for WordPress",
  "summary": "Bricksforge for WordPress through version 3.1.8.9 does not adequately validate a user-supplied file reference during form handling. A remote unauthenticated attacker can upload a server-executable file and run PHP code if they can access the plugin's public form-upload workflow.",
  "mitigation": "Disable Bricksforge or its form-upload functionality until the vendor provides an update, and restrict public access to the associated upload workflow where feasible. Configure the web server to prohibit PHP execution in WordPress upload and temporary-file directories.",
  "vendor": "Bricksforge",
  "product": "Bricksforge",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.1.8.9"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Bricksforge",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2266,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 26.652628233333335,
  "t0_at": "2026-10-08T06:42:09.676000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-11T12:36:22.805418+00:00",
      "days": 3.245985294189815,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:42:09.676000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-07T00:00:00+00:00",
      "days": -1,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:42:09.676000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-85097"
    },
    "public_poc": {
      "at": "2026-10-10T04:51:32+00:00",
      "days": 1.9231750462962962,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:42:09.676000+00:00",
      "url": "https://github.com/Wayang1337/CVE-2026-85097"
    },
    "trigger_signal": {
      "at": "2026-10-08T06:42:09.676000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:42:09.676000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85097"
    }
  }
}