SECURITY researchers have disclosed a critical flaw in the Bricksforge WordPress plugin, tracked as CVE-2026-85097, which is being exploited in the wild. The vulnerability carries a CVSS score of 9.8 and allows unauthenticated attackers to upload arbitrary files and execute malicious code, potentially giving threat actors full control of targeted WordPress sites. The issue was fixed in version 3.1.8[.]10; versions 3.1.8[.]9 and earlier remain vulnerable. Exploit activity was detected by Patchstack starting on 7 October 2026.
Bricksforge is a commercial add‑on for the Bricks visual site builder, providing extra tools such as custom forms, animations, an email designer and admin‑area pages. Patchstack’s telemetry points to automated exploitation patterns rather than a single actor: one cluster involved 44 IPs making 56 requests with identical payloads in seconds, and another cluster involved three IPs testing 25 variations of PHP extensions and encodings against a temporary file. The researchers note these patterns indicate automated tooling using rotating proxies or distributed infrastructure.
Patchstack estimates Bricksforge is used on roughly 6,000 websites, underscoring the scale at risk. As with many WordPress vulnerabilities, exploit activity emerged soon after patch availability, reinforcing the need for prompt updates to plugin components and monitoring for suspicious file uploads or PHP activity on affected sites.