Attackers Exploit CVSS Bricksforge WordPress Flaw Enabling code to be run remotely without a login

What happened

Patches have been released in version 3.1.8.10. WordPress (content management system) security company Patchstack said it detected exploitation efforts targeting the flaw on October 7, 2026, at 9:47 p.m.

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE).

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE  Ravie Lakshmanan  Oct 12, 2026 Vulnerability / Web Security A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The security flaw impacts Bricksforge versions up to and including 3.1.8.9. Bricksforge is a WordPress plugin that's advertised as a "Swiss Army knife" for Bricks, a visual website-building tool for WordPress, with support for animations, advanced forms, and scrolling video sequences.

Key facts

• Patches have been — released: in version 3.1.8.10