Critical Bricksforge WordPress Plugin Flaw Triggers Unauthenticated Remote Code Execution

A newly disclosed vulnerability in the Bricksforge plugin for WordPress is being actively leveraged by threat actors, security researchers at Patchstack confirmed. The flaw, catalogued as CVE-2026-85097, carries a perfect CVSS rating of 10.0, indicating that it enables remote code execution without any authentication.

The defect resides in the plugin's file‑upload handling routine, allowing an attacker to place arbitrary PHP code on a compromised site. Once the malicious payload is uploaded, it can be executed with the same privileges as the web server, potentially granting full control over the affected WordPress installation.

WordPress powers roughly one‑third of all websites worldwide, and its extensible architecture relies heavily on third‑party plugins to add functionality. Bricksforge, a visual‑builder tool popular among designers for its drag‑and‑drop interface, has seen rapid adoption since its launch. That popularity makes the current exploit especially concerning, as any site running the plugin and failing to update may be exposed.

Patchstack’s threat‑intelligence feed indicates that exploitation attempts have been observed in the wild, with attackers probing vulnerable sites and deploying web shells to maintain persistence. While the exact scale of compromise remains unclear, the presence of active exploitation underscores the urgency for site owners to apply the vendor’s patch, which was released shortly after the vulnerability was reported.

Experts advise administrators to verify that the Bricksforge plugin version is up to date, review server logs for suspicious file uploads, and consider temporary removal of the plugin if an immediate update is not feasible. The broader WordPress community continues to stress the importance of routine maintenance, including regular plugin audits and the use of security‑focused hosting configurations, to mitigate the risk of similar high‑impact flaws.