A critical vulnerability in the Bricksforge WordPress plugin is being exploited in the wild, according to WordPress security company Patchstack.
The vulnerability is tracked as CVE-2026-85097 and it has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code.
This can allow threat actors to take full control of the targeted WordPress websites.
The security hole was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected.
Patchstack started seeing in-the-wild exploitation attempts on October 7.
Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites.
“Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.”
The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.”
It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself.
Related: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Related: Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Related: WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
