Science & Tech · Cybersecurity · 1 hr ago
Attackers Exploit Critical Bricksforge Flaw in WordPress Sites
A critical security flaw in the Bricksforge plugin for WordPress is being actively exploited.
Bricksforge adds features to Bricks, a visual website-building tool, and the flaw affects plugin versions up to and including 3.1.8.9.
Attackers do not need an account to exploit it.
They can misuse information submitted with an uploaded file to place PHP code on a website and make the server run it.
That could let them take control of the site, access sensitive data or keep access for later.
Exploitation was detected on October 7, 2026.
A fix is available in Bricksforge version 3.1.8.10.
Attackers are actively exploiting a critical flaw in the Bricksforge plugin for WordPress, according to Patchstack.
The flaw, CVE-2026-85097, allows unauthenticated attackers to upload and execute arbitrary PHP code on affected websites.
It affects Bricksforge versions up to and including 3.1.8.9, and a patch is available in version 3.1.8.10.
Patchstack said it first detected exploitation attempts on October 7, 2026.
- Who
- Unauthenticated attackers are targeting vulnerable WordPress websites.
- What
- They are exploiting CVE-2026-85097 in Bricksforge to upload and execute PHP code.
- When
- Patchstack detected exploitation attempts on October 7, 2026, at 9:47 p.m. UTC.
- Where
- On websites running affected versions of the Bricksforge WordPress plugin.
- Why
- The flaw lets attackers execute arbitrary PHP code, potentially enabling them to take control of a site.
This story does not have two clearly opposing sides.
Bricksforge validates a file's MIME type when it is first uploaded. When a form is later submitted, however, it trusts the file metadata the client sends.
An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed,
Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.
Patchstack detected exploitation efforts targeting the flaw.
The Hacker News published its report on the active exploitation.
- Vulnerability
- CVE-2026-85097
- Severity
- CVSS score of 10.0
- Affected versions
- Bricksforge versions up to and including 3.1.8.9
- Patched version
- Bricksforge 3.1.8.10
- Observed exploitation
- Patchstack detected attempts on October 7, 2026, at 9:47 p.m. UTC
Sources
Related news
CyberXero campaign exposes more than 628,000 Ukrainian records
Let’s Encrypt to shorten default certificate validity to 64 days in 2027
FBI reports another ShinyHunters arrest as AI finds exploited vulnerability
Ransomware Groups Exploit Unpatched Palo Alto VPN Vulnerability
Ledger Confirms Hardware Implant in Wallet Sold by Authorized Reseller
Agentic AI creates new security and governance challenges for businesses
Armadin Security raises $255.5 million in Series B funding
Ricardo warns of WhatsApp scams after personal data leak
SonicWall SMA1000 flaw exploited two days after disclosure
Potential breach may expose data of 8.7 million karaoke customers in Japan
US seizes two China-linked hacking tools used against critical infrastructure
