🔴 Critical: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
-
A maximum-severity vulnerability in the Bricksforge plugin for WordPress is now being actively exploited in the wild, according to Patchstack. The flaw, tracked as CVE-2026-85097, carries a CVSS score of 10.0, the highest possible severity rating.
The issue allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress sites, resulting in remote code execution (RCE). Because no authentication is required to trigger the flaw, any exposed installation running an affected version of the plugin is potentially at risk of full site compromise.
Key points:
- Affected software: Bricksforge plugin for WordPress
- Identifier: CVE-2026-85097
- Severity: CVSS 10.0 (critical)
- Impact: unauthenticated arbitrary PHP upload and execution, leading to RCE
- Status: active exploitation confirmed in the wild by Patchstack
Site administrators running Bricksforge should treat this as urgent: verify whether the plugin is installed, check for any signs of unexpected file uploads or modified PHP files, and apply the vendor's fix or remove the plugin if no patch is available. Given the unauthenticated nature of the flaw, internet-facing instances should be prioritized for review.
Source: The Hacker News
Is your organization running Bricksforge, and if so, have you already patched or pulled the plugin?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login