Maximum-Severity Bricksforge WordPress Flaw Is Being Exploited: Update Now

A maximum-severity vulnerability in the Bricksforge plugin for WordPress is being exploited in the wild, according to security company Patchstack. Tracked as CVE-2026-85097 and rated 10.0 on the CVSS scale, the flaw lets an attacker with no login upload and run arbitrary PHP code on a vulnerable website, which results in remote code execution. All Bricksforge versions up to and including 3.1.8.9 are affected, and a fix is available in version 3.1.8.10.

Bricksforge is an add-on for Bricks, a visual website-building tool, and offers features such as animations and advanced forms. Patchstack explained that the plugin checks a file's type when it is first uploaded, but when a form is later submitted it trusts the file details sent by the user's browser. In particular, it does not validate the URL field in the temporaryFileUploads parameter. Patchstack detected exploitation attempts on 7 October 2026 at 9:47 p.m. UTC, targeting the plugin's form submission endpoints.

If an attacker succeeds, they could take control of the WordPress site, deploy web shells, read sensitive data and establish persistent access. For a small business, that could mean a compromised website, exposed customer information and a long clean-up. Site owners running Bricksforge should treat this as urgent.