CVE

CVE-2019-9879

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.

Exploitation IoCs 8

Filename img_example.gif

Filename img_example.php

IP 150[.]109[.]16[.]166

IP 153[.]75[.]90[.]146

IP 177[.]75[.]57[.]20

IP 23[.]97[.]62[.]146

IP 38[.]154[.]185[.]97

IP 84[.]247[.]60[.]125

MITRE ATT&CK TTPs 5

T1003

OS Credential Dumping

Credential Access

T1027

Obfuscated Files or Information

Exploit Public-Facing Application

Initial Access

Source Articles

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A critical vulnerability, CVE-2026-85097 (CVSS 10.0), in the Bricksforge WordPress plugin is under active exploitation, enabling unauthenticated remote code execution (RCE). Attackers exploit a flaw in file upload validation by uploading a GIF/PHP polyglot file and manipulating the 'temporaryFileUploads' parameter to execute PHP code via mismatched URL extensions. Exploitation targets the '/wp-json/bricksforge/v1/form_submit' or '/wp-admin/admin-ajax.php' endpoints with crafted payloads, using techniques like alternate PHP extensions, case manipulation, and URL encoding to bypass filters. At least 63 unique IPs have been observed in attack campaigns, with six responsible for nearly half of all requests, indicating automated, distributed exploitation. Users are urged to update to version 4.0.1 and audit for suspicious form submissions and unexpected PHP files in upload directories.

hacker-news Oct 12, 2026