Posting this in case it’s useful. Patchstack reported active exploitation of a file upload flaw in Bricksforge’s Pro Forms, starting 7 Oct. It lets anyone upload a PHP file without logging in. Fixed in 3.1.8.10.
If you updated after 7 Oct, it’s still worth checking, because updating doesn’t remove a file that was already uploaded. Quick checks:
- Look in
wp-content/uploads/bricksforge/tmp/for anything that isn’t an image - Look for PHP files anywhere in uploads, including
.phtml,.php5,.php8,.phtand upper-case.PHP. With SSH:
find wp-content/uploads -type f -regextype posix-extended \
-iregex '.*\.(php[0-9]?|pht|phtm|phtml|phar|phps)$' ! -name index.php
- Check for admin users you don’t recognise
I wrote up the full steps (including without SSH, log checks and cleanup) here:
Disclosure: I’m the developer of Moatline, a free malware scanner mentioned in the guide. The checks above work without it.