Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Attackers are exploiting critical Bricksforge flaw CVE-2026-85097 for unauthenticated file upload and code execution.
Patchstack says attackers are exploiting CVE-2026-85097, a critical flaw in the Bricksforge WordPress plugin with a CVSS score of 9.8. Unauthenticated attackers can upload arbitrary files and execute code, potentially taking over affected sites. Versions 3.1.8.9 and earlier are vulnerable; 3.1.8.10 is patched. Exploitation attempts began on October 7 against a plugin used by roughly 6,000 sites, with automated clusters that Patchstack did not attribute to one actor.
74