The issue allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress sites, resulting in remote code execution (RCE). Because no authentication is required to trigger the flaw, any exposed installation running an affected version of the plugin is potentially at risk of full site compromise.

Key points:

• Affected software: Bricksforge plugin for WordPress
• Identifier: CVE-2026-85097
• Severity: CVSS 10.0 (critical)
• Impact: unauthenticated arbitrary PHP upload and execution, leading to RCE
• Status: active exploitation confirmed in the wild by Patchstack

Site administrators running Bricksforge should treat this as urgent: verify whether the plugin is installed, check for any signs of unexpected file uploads or modified PHP files, and apply the vendor's fix or remove the plugin if no patch is available. Given the unauthenticated nature of the flaw, internet-facing instances should be prioritized for review.

Source: The Hacker News

Is your organization running Bricksforge, and if so, have you already patched or pulled the plugin?