Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Bricksforge WordPress plugin vulnerability (CVE-2026-85097) is being exploited in the wild.
Run Patchstack?
Get an email when a reviewed story names Patchstack, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability, CVE-2026-85097, in the Bricksforge WordPress plugin is actively being exploited by attackers. The flaw allows unauthenticated users to upload arbitrary files and execute malicious code, potentially leading to full website compromise. The vulnerability has a CVSS score of 9.8 and affects versions prior to 3.1.8.10, which has been released to patch the issue.
The lesson from this incident
Full lessonA critical unauthenticated file upload vulnerability (CVE-2026-85097, CVSS 9.8) in the Bricksforge WordPress plugin is being actively exploited in the wild, allowing attackers to upload malicious files and execute arbitrary code without any credentials. This represents a worst-case scenario for web application security, as no authentication barrier exists to slow attackers down. The root cause lies in a failure to validate and restrict file uploads at the plugin level, combined with delayed patching by site owners. Because WordPress plugins are widely deployed across millions of sites, a single unpatched vulnerability can have massive downstream impact. Organizations running WordPress must treat third-party plugin vulnerabilities with the same urgency as core platform flaws.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-85097