A severe security flaw discovered in the popular Bricksforge WordPress plugin has triggered an urgent alert within the cybersecurity community. According to reports from the WordPress security firm Patchstack, the vulnerability is currently being actively exploited in the wild by threat actors seeking to compromise websites built with the Bricks visual builder. The flaw, tracked under the identifier CVE-2026-85097, carries a maximum severity CVSS score of 9.8, signaling an immediate and critical risk to any site administrator who has not yet updated their software.<\/p>\n
The vulnerability is categorized as an unauthenticated arbitrary file upload flaw. This classification is particularly concerning for website owners because it allows attackers to bypass standard authentication protocols entirely. By exploiting this gap in the plugin\u2019s code, a remote, unauthenticated attacker can upload malicious files directly to the target server. Once these files are uploaded, the attacker can execute arbitrary code, effectively granting them total control over the compromised WordPress installation. This level of access enables hackers to siphon sensitive data, inject malicious scripts, redirect traffic to fraudulent domains, or even use the site as a launchpad for further attacks against other infrastructure.<\/p>\n
Bricksforge, a commercial add-on designed to extend the functionality of the Bricks visual site builder, provides users with a suite of sophisticated tools. These include custom form builders, complex animation engines, advanced email design interfaces, and custom admin-area page management. Because of its deep integration into the site-building workflow, it is utilized by approximately 6,000 websites globally. While this number is smaller than some massive, ubiquitous plugins, the high-privilege nature of the tools it provides makes it a prime target for attackers looking to maximize the impact of their intrusions.<\/p>\n
The security researchers at Patchstack confirmed that the vulnerability affects all versions of the Bricksforge plugin up to and including 3.1.8.9. The vendor has since issued a patch in version 3.1.8.10, which addresses the flaw and secures the file upload process. Administrators are strongly urged to verify their installation version immediately and apply the update if they are running any version older than 3.1.8.10.<\/p>\n
The urgency of the situation is compounded by the fact that Patchstack observed the first instances of active exploitation on October 7. The firm\u2019s telemetry data provides a sobering look at how these attacks are being orchestrated. According to Patchstack\u2019s analysis, the exploitation attempts are not merely random or sporadic; they follow distinct, highly automated patterns.<\/p>\n
"Two clusters stand out in our telemetry," the Patchstack security team explained in their report. "In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file."<\/p>\n
These observations suggest that the attackers are leveraging sophisticated, distributed infrastructure, such as rotating proxy networks, to mask their origins and evade basic rate-limiting or IP-based blocking mechanisms. The variety of PHP extensions and encoding methods tested by the attackers in the second cluster indicates a methodical effort to bypass server-side security filters that might otherwise block the execution of malicious scripts. Patchstack noted that while these patterns show a high degree of automation and organization, they do not currently allow for definitive attribution to a single known threat actor or group. Instead, they represent a broader trend of automated scanning and exploitation that targets known vulnerabilities as soon as they are identified.<\/p>\n
The timeline of the Bricksforge incident is representative of a larger, persistent problem within the WordPress ecosystem. Threat actors frequently monitor security disclosures, vulnerability databases, and plugin changelogs, launching attacks against sites almost immediately after a patch is released. This creates a "race condition" between security-conscious administrators and attackers: the former must patch their systems before the latter can automate their exploitation scripts to scan the web for unpatched sites.<\/p>\n
This cat-and-mouse game has played out numerous times in recent years, affecting both major and minor plugins alike. In many cases, critical flaws in WordPress components\u2014ranging from site migration tools to specialized visual builders\u2014have left hundreds of thousands of websites exposed to takeover. The rapid weaponization of these vulnerabilities underscores the necessity of a proactive security posture. Relying solely on automatic updates can sometimes be insufficient if the update cycle is delayed or if the site administrator has disabled automatic background updates for plugins.<\/p>\n
The security of the broader WordPress ecosystem relies on the diligence of plugin developers, the speed of security researchers, and the responsiveness of site administrators. When a vulnerability like CVE-2026-85097 is disclosed, the window of opportunity for an attacker is often very small, sometimes spanning only hours from the time a patch is announced to the first widespread automated exploitation attempts.<\/p>\n
For administrators of websites using Bricksforge, the recommended course of action is twofold. First, the immediate application of version 3.1.8.10 is the only way to close the security hole. Second, administrators should conduct a thorough audit of their site\u2019s file structure to ensure that no malicious files were uploaded prior to the update. Because the vulnerability allowed for unauthenticated file uploads, it is possible that an attacker may have already gained a foothold on a site before the patch was applied. Looking for unauthorized PHP files in the media upload directories or checking server access logs for anomalous, high-frequency requests from unknown IP addresses can help in identifying signs of a previous compromise.<\/p>\n
As the digital landscape continues to grow more complex, the frequency of such targeted attacks against third-party plugins is unlikely to decrease. Many WordPress users rely on a stack of third-party plugins to provide necessary functionality, and each plugin represents a potential surface for exploitation. The Bricksforge incident serves as a stark reminder that even tools used for design and site enhancement can become liabilities if they are not maintained with rigorous security standards.<\/p>\n
The vulnerability discovered in Bricksforge fits into a long history of critical flaws affecting the WordPress ecosystem, where plugins designed to enhance user experience often end up providing the very mechanism by which an attacker can compromise a site. From the exploitation of migration plugins that expose databases to RCE (Remote Code Execution) vulnerabilities in contact form and visual building tools, the threat landscape remains dynamic. As Patchstack and other security researchers continue to monitor these trends, they emphasize that maintaining an up-to-date environment is not merely a recommendation, but a fundamental requirement for operating any online platform.<\/p>\n
For the 6,000 or so websites utilizing Bricksforge, the focus remains on patching and verifying the integrity of their installations. By staying informed through official developer communications and security advisories, site owners can navigate these threats more effectively. The swift action by the Bricksforge development team in providing a patch has mitigated the risk, but the responsibility ultimately rests with the administrators to ensure those protections are implemented across their digital infrastructure. The automated nature of the ongoing exploitation attempts serves as a warning that the threat is persistent, and the best defense remains a vigilant and timely response to security updates.<\/p>\n","protected":false},"excerpt":{"rendered":"
A severe security flaw discovered in the popular Bricksforge WordPress plugin has triggered an urgent…<\/p>\n","protected":false},"author":17,"featured_media":1467,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[373],"tags":[1221,1386,374,201,1222,144,1388,5,202,773,1387],"class_list":["post-1468","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bug-bounty-vulnerabilities","tag-active","tag-bricksforge","tag-bug-bounty","tag-critical","tag-exploitation","tag-hacking","tag-plugin","tag-security","tag-vulnerabilities","tag-vulnerability","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1468"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1468\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/1467"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}