Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Attackers are exploiting critical Bricksforge flaw CVE-2026-85097 for unauthenticated file upload and code execution.
Patchstack says attackers are exploiting CVE-2026-85097, a critical flaw in the Bricksforge WordPress plugin with a CVSS score of 9.8. Unauthenticated attackers can upload arbitrary files and execute code, potentially taking over affected sites. Versions 3.1.8.9 and earlier are vulnerable; 3.1.8.10 is patched. Exploitation attempts began on October 7 against a plugin used by roughly 6,000 sites, with automated clusters that Patchstack did not attribute to one actor.
- CVE-2026-85097 scores 9.8 and allows unauthenticated file upload and code execution.
- Bricksforge 3.1.8.10 fixes it; 3.1.8.9 and earlier are affected.
- Patchstack saw exploitation attempts starting October 7.
- About 6,000 sites use the plugin; activity looks automated and unattributed.
Vulnerabilities mentionedAll →
- CVE-2026-850979.8<1%Unauthenticated file upload to RCE in WordPress Bricksforgepublished · Bricksforge PoC ×5
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-85097 | Unauthenticated file upload to RCE in WordPress Bricksforge |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 3.1.8.9 | was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected. Patchstack started seeing in-the- |
Full article259 words · extracted from securityweek.com · click to collapse
A critical vulnerability in the Bricksforge WordPress plugin is being exploited in the wild, according to WordPress security company Patchstack.
The vulnerability is tracked as CVE-2026-85097 and it has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code.
This can allow threat actors to take full control of the targeted WordPress websites.
The security hole was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected.
Patchstack started seeing in-the-wild exploitation attempts on October 7.
Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites.
Advertisement. Scroll to continue reading.
“Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.”
The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.”
It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself.
Related: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Related: Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Related: WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
Text extracted automatically; images, tables and formatting may be missing. Original: