According to WordPress security company Patchstack, a critical vulnerability is being exploited in the Bricksforge WordPress plugin.
The vulnerability is tracked as CVE-2026-85097 and has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code.
This allows threat actors to gain full control over the targeted WordPress websites.
The security hole was closed with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected.
Patchstack started to see Exploitation in the wild Try October 7th.
Bricksforge is a commercial add-on for the visual site builder Bricks that embeds additional tools on WordPress sites, such as custom forms, animations, an email designer, and admin pages. Patchstack reported that around 6,000 websites use it.
“Two clusters stand out in our telemetry,” Patchstack explained. “In the first case, 44 IPs sent 56 requests with identical payloads within seconds. In the second test, three IPs tested 25 variations of PHP extensions and coding using the same temporary file.”
The company added: “Both patterns suggest automated exploitation via rotating proxies or distributed infrastructure. They alone do not attribute the activity to a single threat actor.”
It is not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin bugs and vulnerabilities affecting WordPress itself.
Related: Over 3 million WordPress sites affected by migration plugin vulnerability
Related: Unauthenticated RCE errors could lead to the takeover of more than 200,000 WordPress sites
Related: WordPress websites attacked via vulnerabilities in the MiniOrange plugin
