WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code

Attackers are targeting a critical security flaw in the Bricksforge WordPress plugin that lets them upload and run arbitrary PHP code without logging in. Tracked as CVE-2026-85097, the vulnerability carries a maximum CVSS score of 10.0 and can lead to remote code execution on affected websites. Patchstack first observed exploitation attempts on October 7, 2026, at 21:47:17 UTC. The flaw affects Bricksforge versions up to and including 3.1.8.9. Patchstack identifies version 3.1.8.10 as the fixed release. Bricksforge extends Bricks Builder with advanced forms, animations, dynamic data tools, and site controls. Its form upload process is at the center of this attack. According to Patchstack’s technical report, Bricksforge checks a...

Read the full article at the source.