A critical security vulnerability has been discovered in the Bricksforge WordPress plugin, putting websites running outdated versions at serious risk.
The vulnerability, identified as CVE-2026-85097, allows attackers to potentially execute malicious code on affected WordPress websites without logging in.
Security researchers at Patchstack confirmed active exploitation attempts beginning October 7, 2026.
If your website uses Bricksforge, updating immediately and checking for suspicious activity should be your top priorities.
Bricksforge Vulnerability: Quick Overview
| Details | Information |
|---|---|
| Plugin | Bricksforge |
| Vulnerability ID | CVE-2026-85097 |
| Severity | Critical |
| CVSS Score | 10.0 (Patchstack); 9.8 (CVSS v3.1) |
| Affected Versions | 3.1.8.9 and earlier |
| First Patched Version | 3.1.8.10 |
| Latest Verified Release | 4.0.2 (October 13, 2026) |
| Attack Type | Arbitrary file upload / Remote code execution |
| Exploitation Status | Active attacks reported |
| Recommended Action | Update immediately and investigate possible compromise |
What Is the Bricksforge WordPress Vulnerability?
Bricksforge is a premium WordPress plugin that extends Bricks Builder with advanced forms, animations, dynamic content, and website customization tools.
The vulnerability affects its file-handling functionality.
According to Patchstack, insufficient validation of uploaded-file information could allow an unauthorized attacker to place malicious PHP code on a vulnerable server.
This creates a remote code execution (RCE) risk.
In simple terms, an attacker could potentially run unauthorized commands through the website.
Unlike vulnerabilities requiring an administrator account, this issue can be exploited without authentication.
Is CVE-2026-85097 Being Actively Exploited?
Yes.
Patchstack reported detecting exploitation attempts on October 7, 2026, at approximately 21:47 UTC.
Researchers observed activity originating from 63 distinct IP addresses.
These findings indicate real-world attempts to compromise vulnerable websites, not merely a theoretical security weakness.
However, an exploitation attempt doesn’t automatically mean every targeted website was successfully compromised.
Website administrators should still investigate their security logs, especially if they used an affected version during the attack period.
What Are the Security Risks?
Successful exploitation could expose a WordPress website to serious threats, including:
- Unauthorized website modifications
- Malicious PHP file uploads
- Website defacement
- Theft of sensitive information
- Installation of malicious backdoors
- Unauthorized administrator access
- Persistent website compromise
Businesses running WooCommerce or collecting customer information should treat the issue particularly seriously.
A security breach can disrupt operations and damage customer trust.
Which Bricksforge Versions Are Safe?
Bricksforge versions 3.1.8.9 and earlier are vulnerable to CVE-2026-85097.
The initial security fix was released in version 3.1.8.10.
The developer also confirmed that version 4.0.0 includes the fix.
Version 4.0.1 introduced additional Pro Forms upload protection, while version 4.0.2, released October 13, added further REST API security improvements.
Recommendation: Install the latest supported release, rather than relying only on the minimum patched version.
How to Fix the Bricksforge Vulnerability
Follow these steps to protect your website.
Step 1: Check Your Plugin Version
Open your WordPress dashboard.
Navigate to Plugins → Installed Plugins and locate Bricksforge.
Check the installed version.
Step 2: Create a Complete Backup
Back up your website files and database before making changes.
If you suspect a compromise, preserve relevant logs and evidence before restoring anything.
Step 3: Update Bricksforge
Download the latest official release from the developer and install it through your normal update process.
Avoid installing outdated or unverified plugin packages.
Step 4: Scan Your Website
Use a reputable WordPress security scanner to investigate suspicious files and unexpected changes.
Review administrator accounts, installed plugins, and recent modifications.
Step 5: Review Security Logs
Check server and application logs dating back to October 7, 2026.
Look for suspicious file uploads, unusual requests, and unexpected PHP files.
Step 6: Secure Your Website
If compromise is suspected, contact your hosting provider or a qualified incident-response professional.
Rotate affected credentials and API keys, remove confirmed malicious files, and restore from a known-clean backup when appropriate.
Important: Updating fixes the vulnerable software but doesn’t automatically remove malware already installed.
How to Prevent Future WordPress Plugin Attacks
Protecting WordPress requires ongoing maintenance.
Keep WordPress core, themes, and plugins updated. Remove unused extensions, enable two-factor authentication, and maintain reliable backups.
Use a web application firewall where appropriate and regularly review administrator accounts.
For commercial plugins, ensure you receive security updates promptly from a trustworthy source.
Frequently Asked Questions
What is CVE-2026-85097?
It’s a critical arbitrary file upload vulnerability affecting older Bricksforge WordPress plugin versions.
Which Bricksforge versions are vulnerable?
Versions up to and including 3.1.8.9.
Has the vulnerability been fixed?
Yes. Version 3.1.8.10 contains the initial fix. Newer releases include additional security improvements.
Are hackers exploiting this vulnerability?
Yes. Patchstack confirmed active exploitation attempts beginning October 7, 2026.
Is updating enough to secure my website?
Updating closes the known vulnerability, but previously compromised websites may require malware removal and additional security checks.
Final Verdict
The Bricksforge WordPress vulnerability CVE-2026-85097 is a serious security issue requiring immediate attention.
With active exploitation confirmed, website owners should update Bricksforge, review suspicious activity, and investigate potential compromises.
For more WordPress security updates, plugin reviews, and website protection guides, visit GPLNESTS.COM.
