Vulnerabilities
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.
By
|
October 12, 2026 (9:14 AM ET)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Bricksforge WordPress Plugin Vulnerability Exploited in the Wild https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/) [+ Whatsapp](whatsapp://send?text=Bricksforge WordPress Plugin Vulnerability Exploited in the Wild https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/) + Email
A critical vulnerability in the Bricksforge WordPress plugin is being exploited in the wild, according to WordPress security company Patchstack.
The vulnerability is tracked as CVE-2026-85097 and it has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code.
This can allow threat actors to take full control of the targeted WordPress websites.
The security hole was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected.
Patchstack started seeing in-the-wild exploitation attempts on October 7.
Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites.
Advertisement. Scroll to continue reading.
“Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.”
The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.”
It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself .
Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
Written By
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Eduard Kovacs
- Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security
- Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
- Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
- US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
- TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
- Oracle Health Data Breach Tally Climbs to Nearly 20 Million
- Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
- Advantest Discloses Data Breach Months After Ransomware Attack
Latest News
- IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion
- Canonical Websites Disrupted in Second DDoS Attack This Year
- Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
- iRhythm Data Breach Impacts at Least 360,000 People
- Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
- Critical SonicWall Vulnerability Exploited Days After Disclosure
- Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
- Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Trending
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Critical SonicWall Vulnerability Exploited Days After Disclosure
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
iRhythm Data Breach Impacts at Least 360,000 People
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Security Awareness Training Isn’t Dead, but It Needs a Rethink
Canonical Websites Disrupted in Second DDoS Attack This Year
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
## Webinar: AI Is Accelerating Risk. Can Your IT Operations Keep Up?
October 14, 2026
Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.
## Virtual Event: Zero Trust & Identity Strategies Summit 2026
October 14, 2026
Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.
People on the Move
Rapid7 has named Rik Ferguson as VP of Security Intelligence.
Cytactic has appointed Tim Brown as CSO.
Scott Simkin has joined Vega as CMO.
Expert Insights
## AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)
## Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)
## Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)
## “We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)
## This Key Will Self-Destruct: An Open Standard for Revocable API Keys
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Bricksforge WordPress Plugin Vulnerability Exploited in the Wild https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/) [+ Whatsapp](whatsapp://send?text=Bricksforge WordPress Plugin Vulnerability Exploited in the Wild https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/) + Email
Popular Topics
Security Community
- Virtual Cybersecurity Events
- Webcast Library
- CISO Forum
- AI Risk Summit
- ICS Cybersecurity Conference
- Cybersecurity Newsletters
Stay Intouch
About SecurityWeek
News Tips
Got a confidential news tip? We want to hear from you.
Advertising
Reach a large audience of enterprise cybersecurity professionals
Daily Briefing Newsletter
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.