Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

CVE-2026-85097 is a critical unauthenticated remote code execution vulnerability in the Bricksforge WordPress plugin, which enables attackers to upload arbitrary files and execute malicious code on targeted WordPress sites. This vulnerability affects versions up to and including 3.1.8.9 and was fixed in version 3.1.8.10. Exploitation attempts have been detected in the wild, characterized by automated requests from multiple IPs testing various payloads and PHP extensions. The plugin is a commercial add-on for the Bricks visual site builder, adding features like custom forms and animations. The vulnerability's exploitation can lead to full site takeover.

Successful exploitation allows unauthenticated attackers to upload arbitrary files and execute malicious code, resulting in full control over the targeted WordPress websites. This can lead to site defacement, data theft, malware distribution, or use of the compromised site in further attacks. The vulnerability is critical with a CVSS score of 9.8, reflecting its high impact and ease of exploitation.

The vulnerability has been patched in Bricksforge plugin version 3.1.8.10. Site administrators should update to this version immediately to mitigate the risk. Since exploitation attempts have been observed in the wild, timely patching is critical. No additional vendor advisories indicate alternative mitigations or that no action is required.