Bricksforge WordPress Plugin Flaw Exploited in the Wild

Attackers are exploiting a critical vulnerability in the Bricksforge WordPress plugin, according to WordPress security company Patchstack. The flaw, tracked as CVE-2026-85097, allows unauthenticated users to upload arbitrary files and execute malicious code. It can give attackers full control of affected websites.

The vulnerability has a CVSS score of 9.8, placing it in the critical severity category. Patchstack began detecting exploitation attempts on October 7.

Bricksforge fixed the issue in version 3.1.8.10. Versions 3.1.8.9 and earlier are affected. Administrators using the plugin should update to the patched release.

Bricksforge is a commercial add-on for the Bricks visual site builder, which runs on WordPress. It adds tools such as custom forms, animations, an email designer and pages for WordPress administration areas. Patchstack estimates that the add-on is installed on about 6,000 websites.

Patchstack’s telemetry showed two activity clusters. In the first, 44 IP addresses sent 56 requests with identical payloads within seconds of one another. In the second, three IP addresses tested 25 variations of PHP file extensions and encodings against the same temporary file.

The company described both patterns as automated exploitation using rotating proxy servers or distributed infrastructure. The activity does not identify a single threat actor.

Attackers can use plugin flaws to upload web shells, run commands on servers and access website data or administrative functions. WordPress plugin vulnerabilities are often targeted after patches become available.