Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
Attackers are exploiting CVE-2026-85097, a CVSS 10 file-upload flaw in the Bricksforge WordPress plugin.
Patchstack says CVE-2026-85097, a CVSS 10.0 unauthenticated arbitrary file upload flaw in the Bricksforge WordPress plugin, is under active exploitation. Versions through 3.1.8.9 are affected, and 3.1.8.10 contains the fix. Exploitation was first observed on October 7, 2026, mainly against the plugin's form submission endpoint. Successful attacks can place PHP files on the server, enabling remote code execution, web shells, and data theft.
71