A severe security flaw discovered in the Bricksforge WordPress plugin is currently being actively exploited by malicious actors on the internet, according to recent warnings issued by WordPress security firm Patchstack. The vulnerability poses a critical threat to thousands of websites utilizing the popular design tool, allowing unauthorized individuals to achieve remote code execution and potentially seize total administrative control over compromised systems.
Tracked under the identifier CVE-2026-85097, the security hole has been assigned the maximum possible severity rating of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS). This high score reflects the dangerous nature of the flaw, which stems from an unauthenticated arbitrary file upload vulnerability. Because the security weakness requires no prior authentication, virtually anyone on the public internet can interact with vulnerable endpoints to upload malicious files, execute arbitrary code, and completely compromise the underlying web server hosting the WordPress installation.
The security issue specifically affects Bricksforge versions 3.1.8.9 and all earlier iterations. Recognizing the immense risk posed by the flaw, the developers behind the plugin moved quickly to deploy a security patch. The vulnerability was officially resolved with the release of version 3.1.8.10, which implements stricter controls and validation mechanisms to prevent unauthorized file uploads.
However, the release of a patch has not outpaced the activity of opportunistic threat actors. Patchstack reported that its telemetry systems detected in-the-wild exploitation attempts targeting the vulnerability as early as October 7. The rapid transition from public disclosure or patch availability to active exploitation highlights the persistent challenges facing website administrators in maintaining robust security postures in an environment where automated scanning and attack tools are constantly evolving.
Bricksforge is widely recognized within the WordPress ecosystem as a powerful commercial add-on designed to extend the capabilities of the Bricks visual site builder. By layering a suite of extra tools onto standard WordPress architecture, the plugin empowers web developers and designers to build advanced websites featuring custom forms, complex animations, specialized email designers, and customized admin-area pages. While these features make the plugin popular among professional developers looking to streamline their design workflows, its presence on approximately 6,000 active websites means that thousands of digital storefronts, corporate blogs, and content platforms were exposed to potential takeover until administrators applied the necessary updates.
Security researchers analyzing the automated attack traffic have observed sophisticated patterns indicating that malicious actors are utilizing distributed infrastructure to probe and compromise vulnerable endpoints. Detailed telemetry data shared by Patchstack reveals distinct clusters of malicious activity designed to evade basic detection mechanisms while maximizing the success rate of the attacks.
In the first observed cluster of activity, researchers noted that a coordinated group of 44 unique internet protocol addresses transmitted a total of 56 distinct requests containing identical payloads. These requests were executed within mere seconds of each other, demonstrating a high degree of automated synchronization. In a second distinct pattern, three IP addresses were observed systematically testing 25 different variations of PHP file extensions and complex encodings against the same temporary file destination on target servers.
According to Patchstack, both of these behavioral patterns strongly point toward automated exploitation campaigns operating through rotating proxies or distributed server infrastructure. While the telemetry clearly indicates a concerted effort to locate and exploit unprotected websites at scale, security analysts emphasize that these patterns do not, on their own, conclusively attribute the ongoing malicious activity to a single, identifiable threat actor or advanced persistent threat group. Instead, the behavior aligns with common tactics employed by opportunistic cybercriminals who scan the global web for newly disclosed vulnerabilities to rapidly expand botnets or deploy malicious persistence mechanisms.
The rapid weaponization of CVE-2026-85097 underscores a broader, ongoing trend within the cybersecurity landscape where threat actors continuously monitor vulnerability disclosures and software updates to target web applications. It is frequently observed that cybercriminals reverse-engineer security patches almost immediately after they are made public, utilizing the patch diffs to pinpoint the exact flaw and construct reliable exploit payloads before the majority of site owners have had a chance to update their software. This phenomenon has previously affected a wide array of popular components within the WordPress ecosystem, including prominent plugin flaws and critical weaknesses affecting core WordPress installations.
Website administrators who utilize the Bricksforge plugin are strongly urged to verify their current version numbers and apply the update to version 3.1.8.10 or higher immediately. Because unauthenticated arbitrary file upload vulnerabilities can lead to immediate remote code execution and full site compromise, failing to patch promptly leaves web properties exposed to persistent threats, data theft, and unauthorized server manipulation. Security experts continue to emphasize the importance of maintaining proactive update schedules, implementing robust web application firewalls, and monitoring site telemetry to detect and mitigate unauthorized access attempts before they result in widespread damage.
