Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

A critical vulnerability in the Bricksforge WordPress plugin is being exploited in the wild, according to WordPress security company Patchstack. The vulnerability is tracked as CVE-2026-85097 and it has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code. This can allow threat actors to take full control of the targeted WordPress websites. The security hole was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected. Patchstack started seeing in-the-wild exploitation attempts on October 7. Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites. “Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

The vulnerability is tracked as CVE-2026-85097 and it has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code. This can allow threat actors to take full control of the targeted WordPress websites. The security hole was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected. Patchstack started seeing in-the-wild exploitation attempts on October 7. Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites. “Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

This can allow threat actors to take full control of the targeted WordPress websites. The security hole was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected. Patchstack started seeing in-the-wild exploitation attempts on October 7. Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites. “Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

The security hole was patched with the release of version 3.1.8.10. Versions 3.1.8.9 and earlier are affected. Patchstack started seeing in-the-wild exploitation attempts on October 7. Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites. “Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

Patchstack started seeing in-the-wild exploitation attempts on October 7. Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites. “Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. Patchstack reported that it’s used by roughly 6,000 websites. “Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

“Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses affecting WordPress itself . Related : Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Related : Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover Related : WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.