Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Bricksforge WordPress plugin flaw (CVE-2026-85097) is actively exploited for unauthenticated RCE.
Run Bricksforge?
Get an email when a reviewed story names Bricksforge, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability in the Bricksforge WordPress plugin, rated CVSS 10.0 and identified as CVE-2026-85097, is being actively exploited. This flaw allows unauthenticated attackers to execute arbitrary PHP code on vulnerable websites, leading to remote code execution (RCE). The vulnerability was reported by Patchstack, highlighting the immediate risk to WordPress sites using the affected plugin.
The lesson from this incident
Full lessonA critical flaw in the Bricksforge WordPress plugin (CVE-2026-85097, CVSS 10.0) allows unauthenticated attackers to execute arbitrary PHP code, giving them full control over vulnerable sites without any credentials. The root cause lies in inadequate input validation and missing authentication checks within the plugin's code, a failure that should have been caught during development and pre-release security review. Active exploitation means that any site still running the vulnerable version is at immediate, high risk of complete compromise. This incident underscores how third-party plugins dramatically expand the WordPress attack surface, and why timely patching of external components is as critical as patching the core platform itself.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
- cve — CVE-2026-85097