Critical Bricksforge WordPress Plugin Bug Under Active Attack, Allows Remote Code Execution
A maximum-severity vulnerability in the Bricksforge WordPress plugin is being exploited in real-world attacks, according to Patchstack. Tracked as CVE-2026-85097 with a CVSS score of 10.0, it lets unauthenticated attackers upload and run arbitrary PHP code. Successful exploitation can lead to remote code execution on affected WordPress sites.
The flaw affects Bricksforge, a WordPress plugin, and has been assigned CVE-2026-85097. It carries the highest possible CVSS rating, 10.0, indicating maximum severity. According to Patchstack, attackers are already using it in live campaigns rather than merely theoretical exploitation.
Because the issue can be triggered without authentication, an attacker may upload and execute arbitrary PHP code. If successful, that could give them remote code execution on vulnerable WordPress installations. Site operators should treat the report as urgent, though no further technical or remediation details are provided here.
WordPress powers many websites, so a maximum-severity, actively exploited plugin flaw could affect site owners, visitors, and organizations relying on those sites. If attackers gain remote code execution, they may deface pages, steal data, or use compromised servers for further abuse. The broader ecosystem could face increased cleanup costs and trust concerns, though the actual societal impact depends on how many installations remain vulnerable and how quickly fixes are applied.