A severe security flaw discovered in the Bricksforge WordPress plugin has been confirmed as the target of active, malicious exploitation campaigns. According to research published by the WordPress security firm Patchstack, the vulnerability allows unauthenticated attackers to upload arbitrary files and execute malicious code, potentially granting threat actors full administrative control over compromised websites.
The vulnerability, tracked as CVE-2026-85097, carries a CVSS score of 9.8, the highest possible severity rating. This classification reflects the ease with which an attacker can leverage the flaw without requiring prior authentication or elevated privileges. Because Bricksforge is a popular commercial add-on for the Bricks visual site builder—an essential tool for thousands of designers and developers—the discovery has prompted urgent warnings for site administrators to audit their installations and ensure they are running the latest version of the software.
The Scope of the Threat
Bricksforge is widely utilized to extend the functionality of the Bricks builder, providing a suite of advanced tools that include custom forms, interactive animations, sophisticated email design capabilities, and specialized admin-area management pages. By providing these features, the plugin has become a staple for roughly 6,000 websites, according to Patchstack’s telemetry data. While 6,000 sites may represent a smaller fraction of the global WordPress ecosystem compared to some massive plugins, the nature of the sites that utilize Bricksforge—often professional design portfolios, corporate portals, and customized business sites—makes them high-value targets for attackers looking to leverage hijacked infrastructure for phishing, malware distribution, or unauthorized data access.
The flaw exists in versions 3.1.8.9 and earlier. Following the identification of the vulnerability, the developers released version 3.1.8.10, which contains the necessary security patches. Administrators who have not yet updated their installations are effectively leaving a backdoor open that allows for remote code execution. Once an attacker successfully uploads a malicious script, they can bypass the intended restrictions of the site, modify the database, install backdoors, or exfiltrate sensitive user data, essentially gaining total dominion over the target environment.
Observed Patterns of Exploitation
Patchstack first detected active exploitation attempts on October 7. The firm’s researchers have been closely monitoring the telemetry data surrounding these attacks, identifying distinct patterns that suggest the use of sophisticated, automated, and distributed infrastructure. These findings indicate that the threat actors behind these attacks are not conducting manual, one-off attempts but are instead employing automated scanning and exploitation tools designed to maximize their reach across the internet.
In their analysis, Patchstack highlighted two specific clusters of activity that stood out during the initial surge of attacks. In the first observed pattern, 44 unique IP addresses sent a total of 56 requests containing identical payloads, all occurring within seconds of one another. This "burst" approach is characteristic of a coordinated botnet or a distributed attack network intended to overwhelm a server or ensure a successful hit before a site administrator can detect the anomalous traffic.
The second cluster of activity was arguably more technical. In this instance, three specific IP addresses were observed testing 25 different variations of PHP extensions and file encodings against the same temporary file. This behavior suggests that the attackers were attempting to bypass security filters or web application firewalls (WAFs) that might be configured to block common malicious file types. By cycling through various encodings and extensions, the attackers aimed to find a "sweet spot" where their malicious code could be interpreted and executed by the web server.
Patchstack noted that both of these patterns point toward highly automated exploitation tactics. The use of rotating proxies and distributed infrastructure allows attackers to mask their origin, making it difficult for security teams to block them based on IP address alone. Furthermore, the firm clarified that these patterns do not, by themselves, attribute the activity to a single, known threat actor. Instead, it suggests a broader trend where various malicious entities—ranging from opportunistic cybercriminals to automated script kiddies—leverage public vulnerability disclosures to scan for and exploit unpatched websites as quickly as possible.
The Critical Need for Timely Patching
The situation involving Bricksforge is far from unique. The WordPress security landscape is frequently defined by a "race against the clock" dynamic, where developers release a patch for a vulnerability and threat actors simultaneously begin scanning the internet to find sites that haven’t updated yet. This phenomenon is a recurring headache for site owners and maintenance agencies alike.
History has repeatedly demonstrated that the window between a patch release and active exploitation is often incredibly narrow. Similar vulnerabilities in popular tools like Elementor Pro have previously been exploited to compromise thousands of sites within days of the disclosure. In some instances, vulnerabilities in the WordPress core itself have been targeted within hours, if not minutes, of the release of a security update.
For the administrators of the 6,000 sites using Bricksforge, the message from security experts is clear: the risk of waiting is simply too high. While some administrators may delay updates to ensure compatibility with other plugins or custom themes, a vulnerability with a CVSS score of 9.8 leaves virtually no room for hesitation. In this case, the potential for a complete site takeover outweighs the risk of minor compatibility issues that might arise from an update.
The exploitation of plugins has become one of the primary vectors for WordPress compromise. As the ecosystem grows, so too does the complexity of the plugins that developers create. Every line of code added to a plugin increases the potential surface area for bugs and security flaws. When these plugins are commercial products, they are often widely deployed, making them attractive targets for attackers who know that a single exploit can grant them access to thousands of different servers.
Broader Implications for Site Security
The Bricksforge incident serves as a poignant reminder of the importance of maintaining a proactive security posture. Security professionals emphasize that patching is only one layer of defense. A comprehensive strategy should also include regular backups, the use of robust web application firewalls (WAFs) that can detect and block malicious payloads, and the implementation of the principle of least privilege.
Furthermore, the nature of the Bricksforge vulnerability highlights the risks associated with third-party extensions. When site builders rely heavily on specialized add-ons to provide core functionality, the security of the entire project becomes dependent on the vigilance of the third-party developers who maintain those tools. If those developers are slow to patch or if their internal development processes lack rigorous security auditing, the websites that rely on them remain inherently vulnerable.
As the digital landscape continues to evolve, the frequency and sophistication of these attacks are unlikely to decrease. Automated scanners and distributed attack networks have made it easier than ever for threat actors to find and exploit even the most obscure vulnerabilities. For the WordPress community, the challenge lies in balancing the desire for feature-rich, customizable sites with the reality that every new tool installed is a potential point of failure.
In the wake of the Bricksforge disclosure, Patchstack and other security researchers continue to urge all WordPress users to check their plugin versions. If the version is 3.1.8.9 or earlier, the site should be updated to 3.1.8.10 immediately. For those who suspect their site may have already been compromised, standard remediation steps include reverting to a clean backup, changing all administrative passwords, and conducting a thorough security audit to ensure that no backdoors or malicious scripts were left behind by the attackers.
The incident is a sobering example of how quickly a secure website can become compromised when a critical vulnerability is left unaddressed. By staying informed and acting swiftly when patches are released, site administrators can better protect their digital assets from the persistent threats posed by automated exploitation campaigns. As this situation continues to unfold, the priority for the Bricksforge user base remains the swift application of the latest security updates, ensuring that their sites are fortified against ongoing exploitation attempts.
