WordPress - Bricksforge - CRITICAL - CVE-2026-85097. The Bricksforge plugin for WordPress is susceptible to a serious security flaw that allows unauthenticated users to upload arbitrary files. This vulnerability arises from inadequate validation of the 'temporaryFileUploads' parameter, specifically permitting attackers to exploit the AJAX endpoint to generate a valid nonce. By uploading a carefully crafted GIF/PHP polyglot file, an attacker can manipulate server-side file paths to execute PHP code seamlessly. The implications of this flaw can lead to unauthorized access and control over the server, underscoring the critical need for users to update to secure versions.