A severe security vulnerability affecting the Bricksforge plugin for WordPress has been identified and is currently being exploited by threat actors in the wild. The flaw, which carries a critical CVSS score of 9.8, poses a significant risk to website owners, potentially allowing unauthenticated attackers to gain full administrative control over compromised WordPress installations. Security researchers at Patchstack, a prominent firm specializing in WordPress security, issued the warning this week, urging users to update their installations immediately to prevent unauthorized access and potential data breaches.<\/p>\n
The vulnerability is tracked under the identifier CVE-2026-85097. At its core, the flaw allows an unauthenticated user to bypass standard security protocols to upload arbitrary files to a target server. By leveraging this ability, an attacker can execute malicious code, effectively granting them a foothold within the web environment. Once this initial access is secured, the attacker can escalate their privileges, modify site content, exfiltrate sensitive user data, or deploy secondary payloads such as ransomware or persistent backdoors. Because the vulnerability requires no authentication, the barrier to entry for potential attackers is dangerously low, making any unpatched site a prime target for automated scanning and exploitation campaigns.<\/p>\n
Bricksforge is a popular commercial add-on designed for the Bricks visual site builder. It provides a suite of advanced features that extend the functionality of the base site builder, including custom forms, sophisticated animations, specialized email design tools, and additional admin-area management pages. According to data provided by Patchstack, the plugin is currently utilized by approximately 6,000 websites. While this number is smaller than some of the massive, multi-million-install plugins that frequently make headlines, the nature of the exploit\u2014combined with the target profile\u2014makes it a high-priority concern for the web development community.<\/p>\n
The developers of Bricksforge were alerted to the issue and have released a security patch in version 3.1.8.10. Users who are currently running version 3.1.8.9 or any earlier iteration are considered vulnerable and are strongly advised to perform an update immediately. Given the speed with which attackers are moving to exploit this flaw, the window for remediation is closing rapidly.<\/p>\n
The severity of the situation is underscored by the patterns observed by Patchstack\u2019s threat intelligence team. Patchstack reported that active, in-the-wild exploitation attempts were first detected on October 7. The telemetry gathered by the security firm indicates that the attacks are not merely opportunistic, but appear to be part of a coordinated, automated effort. <\/p>\n
In their analysis, Patchstack researchers highlighted two distinct patterns of activity that suggest the use of sophisticated, distributed infrastructure. In the first observed cluster of activity, researchers noted that 44 unique IP addresses sent 56 requests containing identical payloads in rapid succession, suggesting an automated script testing for the vulnerability across a wide range of targets within seconds. In a second, perhaps more methodical cluster, three specific IP addresses were observed testing 25 different variations of PHP extensions and encodings against a single temporary file. This behavior is indicative of a "fuzzing" or probing technique, where the attacker attempts to determine exactly what kind of file uploads the server will accept and execute, thereby tailoring their payload to bypass any basic file-extension filters that might be in place.<\/p>\n
Patchstack noted that both of these patterns point toward automated exploitation carried out over rotating proxies or a distributed network of compromised machines. While the sophistication of these patterns is notable, the researchers cautioned that these methods are not, on their own, sufficient to attribute the attacks to a single, specific threat actor. Instead, the evidence points to a broader trend of threat actors quickly weaponizing newly discovered vulnerabilities.<\/p>\n
The rapid exploitation of CVE-2026-85097 fits a growing pattern in the cybersecurity landscape, where vulnerabilities in WordPress plugins are targeted almost immediately after disclosure or patch release. This phenomenon creates a "race against time" for site administrators, who must balance the operational requirements of updating their websites with the urgent need to maintain security. The WordPress ecosystem, due to its massive market share and the widespread use of third-party plugins and themes, has long been a primary focus for automated scanning tools.<\/p>\n
This is not an isolated incident. The security community frequently reports on similar exploits targeting various components of the WordPress ecosystem. Whether it is an issue with a widely used migration plugin that could affect millions of sites, or critical remote code execution (RCE) flaws that expose hundreds of thousands of installations to total takeover, the message from security researchers remains consistent: the security of a WordPress site is only as strong as its most vulnerable component. <\/p>\n
The threat is further compounded when vulnerabilities are discovered in plugins that offer elevated privileges or broad administrative access, such as Bricksforge. Because these tools are often deeply integrated into the site\u2019s architecture, an exploit that allows for arbitrary file uploads can be devastatingly effective. Once an attacker successfully uploads a malicious file\u2014often a web shell that provides a persistent command-line interface to the server\u2014they can navigate the site\u2019s file structure, modify database entries, or inject malicious scripts into the front-end, potentially turning the site into a vehicle for infecting the site’s own visitors.<\/p>\n
The risks associated with unpatched WordPress plugins are well-documented. Security professionals often point to the "supply chain" nature of the WordPress plugin market as a significant challenge. A site owner may trust a reputable plugin developer, but if a flaw is discovered and a patch is not applied promptly, that trust can be exploited by third-party attackers. Furthermore, the reliance on automated updates or manual maintenance cycles means that there is often a lag between the release of a patch and the actual deployment of that patch across the thousands of websites that rely on the plugin.<\/p>\n
In the case of Bricksforge, the presence of these automated, rotating-proxy attacks confirms that the threat is not limited to a theoretical risk. These attackers are actively scanning the web, looking for sites that have not yet updated to version 3.1.8.10. The use of multiple IPs and varying payloads suggests that the attackers are refining their approach to ensure their malicious files are successfully uploaded and executed, even against systems that might have minor security hardening measures in place.<\/p>\n
For administrators and site owners, the immediate priority is verification. Confirming the current version of the Bricksforge plugin and ensuring it is at 3.1.8.10 or higher is the only effective defense against this specific vulnerability. Additionally, security experts recommend that WordPress site administrators implement a layered security approach. This includes limiting administrative access to known IP addresses where possible, utilizing web application firewalls (WAF) that can block known malicious patterns, and maintaining regular, off-site backups of the entire website.<\/p>\n
The incident involving Bricksforge serves as a stark reminder of the importance of maintaining an active inventory of all plugins and themes installed on a WordPress site. Often, unused or abandoned plugins serve as a silent point of entry for attackers, as these plugins are rarely updated and often contain known, unpatched vulnerabilities. By auditing installed software and removing any tools that are no longer strictly necessary, site owners can significantly reduce their "attack surface."<\/p>\n
As the digital landscape continues to evolve, the tactics of threat actors are becoming increasingly automated and efficient. The ability of attackers to deploy, test, and exploit a vulnerability within days of its identification\u2014and in some cases, hours\u2014places a significant burden on the maintainers of the WordPress ecosystem. While developers like those behind Bricksforge are tasked with the heavy lifting of identifying and fixing these flaws, the final responsibility for securing an individual installation ultimately rests with the site owner. Staying informed about security advisories, such as those provided by Patchstack and other industry-leading security firms, remains the best defense against the persistent threats facing the modern web.<\/p>\n","protected":false},"excerpt":{"rendered":"
A severe security vulnerability affecting the Bricksforge plugin for WordPress has been identified and is…<\/p>\n","protected":false},"author":5,"featured_media":1431,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[373],"tags":[1221,1386,374,201,1222,144,1388,5,202,773,1387],"class_list":["post-1432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bug-bounty-vulnerabilities","tag-active","tag-bricksforge","tag-bug-bounty","tag-critical","tag-exploitation","tag-hacking","tag-plugin","tag-security","tag-vulnerabilities","tag-vulnerability","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1432"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1432\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/1431"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}