Critical Vulnerability in Bricksforge WordPress Plugin Under Active Exploitation
Urgent Patch Required for Bricksforge Users
A critical security vulnerability affecting the Bricksforge plugin for WordPress is currently being exploited by threat actors in the wild. The flaw, identified as CVE-2026-85097, carries a maximum CVSS severity score of 9.8, underscoring the immediate risk it poses to organizations relying on the popular site-building extension. Security researchers have confirmed that the vulnerability allows unauthenticated attackers to bypass security controls, upload arbitrary files, and execute malicious code on affected servers, effectively granting them full administrative control over the compromised WordPress environment.
Scope and Technical Impact
Bricksforge serves as a commercial enhancement for the Bricks visual builder, providing users with advanced functionality such as custom animation tools, specialized forms, and email design capabilities. Given its utility, the plugin is integrated into approximately 6,000 active websites. The vulnerability impacts all versions of the plugin up to and including 3.1.8.9. Administrators are strongly advised to update to version 3.1.8.10 or higher immediately to mitigate the risk of unauthorized remote code execution (RCE).
Observed Attack Patterns
Threat intelligence telemetry indicates that active exploitation attempts began as early as October 7, 2026. Security analysts have observed distinct attack behaviors that suggest the use of automated infrastructure. In one observed campaign, dozens of unique IP addresses executed identical payloads in rapid succession. A second wave of activity involved attackers testing various PHP extensions and encoding methods against temporary files, a technique often used to bypass basic input validation or security filters. These patterns are consistent with the use of rotating proxies and distributed botnets, indicating a coordinated effort to identify and compromise vulnerable targets at scale.
Defensive Recommendations
The speed at which this vulnerability moved from disclosure to active exploitation highlights the persistent challenge of securing third-party extensions within a content management system architecture. Security teams managing WordPress environments should prioritize the following actions: verify that all instances of the Bricksforge plugin are updated to the latest patched version, conduct a thorough audit of file directories for unauthorized scripts or backdoors, and review server logs for suspicious POST requests originating from unknown or unauthorized IP ranges. As threat actors continue to weaponize plugin vulnerabilities shortly after patch releases, organizations must maintain a proactive posture toward dependency management and vulnerability scanning to ensure that critical updates are applied before attackers can weaponize the underlying flaws.
