Science & Tech · Cybersecurity · 5 hrs ago
Bricksforge WordPress Plugin Flaw Exploited in Ongoing Attacks
A critical security flaw in the Bricksforge plugin for WordPress is being used in attacks.
The flaw lets attackers who do not need to log in upload files and run malicious code, potentially taking full control of affected websites.
Bricksforge adds features such as custom forms and animations to sites built with the Bricks visual site builder.
The flaw affects versions 3.1.8.9 and earlier, and a fix is available in version 3.1.8.10.
The plugin is used by roughly 6,000 websites, and exploitation attempts were first observed on October 7.
The activity appears automated, but the observed patterns do not identify a single attacker.
A critical flaw in the Bricksforge WordPress plugin is being exploited in the wild, according to Patchstack.
Tracked as CVE-2026-85097, the flaw has a CVSS score of 9.8.
Unauthenticated attackers can use it to upload arbitrary files and execute malicious code, potentially taking full control of affected websites.
Versions 3.1.8.9 and earlier are affected, and the flaw was patched in version 3.1.8.10.
Patchstack began seeing exploitation attempts on October 7.
- Who
- Unauthenticated attackers are exploiting the flaw. Patchstack reported the activity.
- What
- A critical Bricksforge plugin vulnerability is being exploited to upload files and execute malicious code.
- When
- Patchstack began seeing attempts on October 7, 2026.
- Where
- WordPress websites using affected versions of the Bricksforge plugin.
- Why
- The flaw allows attackers to upload arbitrary files and execute malicious code. The attackers’ motive is not stated.
This story does not have two clearly opposing sides.
Two clusters stand out in our telemetry
In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other.
In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.
Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.
Patchstack began seeing in-the-wild exploitation attempts.
SecurityWeek reported that the vulnerability was being exploited.
- Vulnerability
- CVE-2026-85097
- CVSS score
- 9.8
- Affected versions
- 3.1.8.9 and earlier
- Fixed version
- 3.1.8.10
- Plugin use
- Roughly 6,000 websites
Sources
Related news
Cyberattack defrosts refrigerators at French supermarket chains
Ledger confirms tampered wallets linked to CryptoBilis fund thefts
Malware incident at contractor may expose 8.7 million karaoke records
Critical SonicWall flaw faces exploitation days after patch
Cyberattack disrupts refrigeration systems at French supermarkets
Albert Heijn systems remain offline after cybersecurity incident
Canadian cybersecurity executive arrested on federal extortion charges
Attacks disrupt Yandex services and its data centers in Russia
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Cyberattacks disrupt French supermarket freezers and Dutch-Belgian retail operations
Exposure management shifts cybersecurity focus from controls to risk
