Active Exploitation of Critical Bricksforge WordPress Plugin Vulnerability

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack researchers. The critical vulnerability, tracked as CVE-2026-85097 with a CVSS score of 10.0, allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE).

The exploitation was reported starting around October 12, 2026. Successful exploitation could lead to full system compromise, enabling attackers to execute arbitrary PHP code, potentially resulting in complete website takeover, data exfiltration, or use of the compromised site as a pivot for further attacks. Patchstack researcher reporting confirmed the active exploitation status, though specific threat actor attribution and detailed exploitation techniques were not disclosed in the advisory.

The Bricksforge plugin is used for WordPress site building and design. Organizations running this plugin should assess their exposure and apply recommended mitigations promptly.