suspectedlowVulnerabilityFirst reported Oct 12, 2026

Bricksforge: critical WordPress plugin flaw CVE-2026-85097 exploited in the wild

Patchstack reports that a maximum-severity flaw (CVE-2026-85097, CVSS 10.0) in the Bricksforge WordPress plugin is under active exploitation. The bug lets unauthenticated attackers upload and execute arbitrary PHP code, enabling remote code execution on affected sites.

Members only

The full record: the timeline and 1 linked report

Every update as it happened, with the status at each step
Every report behind the record, newest first
Alerts the moment Bricksforge — or anything else you track — is hit again

A free account is all it takes — no card, one minute.

Create a free account Log in