A maximum-severity flaw in the Bricksforge WordPress plugin is under active attack. An unauthenticated visitor can turn a file that passed an image check into executable code on the site.
What happened
The Hacker News reported on 12 October that Patchstack detected exploitation of CVE-2026-85097 on 7 October 2026 at 21:47 UTC. The flaw is scored CVSS 10 and affects Bricksforge up to and including 3.1.8.9. A fix shipped in 3.1.8.10.
The plugin checks a file type on first upload, then later trusts metadata supplied by the client, including a URL field. That mismatch lets an attacker place PHP where the site will execute it. Patchstack saw automated attempts from 63 source addresses, including one cluster that tried alternate PHP extensions and encodings. Wordfence published a matching advisory.
Successful use can take over the WordPress site, drop a web shell, read data, and keep access after the first request. Updating the plugin stops new exploitation. It does not remove a shell that is already there.
Who is affected
- WordPress sites running Bricksforge 3.1.8.9 or earlier, especially sites that use Bricksforge forms.
- Internet-facing sites. The attack does not need a login.
- Agencies and shops that host client sites on Bricks, the visual builder this plugin extends.
What to do now
Update Bricksforge to 3.1.8.10 or later. The Hacker News reports the advised current release as 4.0.1, so install the newest vendor build rather than stopping at the first fixed version.
Then search the Bricksforge temporary upload directory for unexpected PHP files, and review form-submission requests that carry temporary file metadata. Check for new administrator accounts and unfamiliar plugins. A clean plugin update is not a cleanup.
Source: The Hacker News, 12 October 2026. Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE.
Also on the blog
- SonicWall SMA1000 CVE-2026-102255 CVSS 10 SSRF Under Attack
- Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access
- CyberXero used Claude Code to steal 628,000 Ukrainian records
- Ledger Confirms Hardware Implant in CryptoBilis Wallets
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.