Critical Bricksforge WordPress Flaw (CVE-2026-85097) Exploited in the Wild: What K-12 IT Teams Must Do Now

CVE-2026-85097: CVSS 10.0 unauthenticated RCE in the Bricksforge WordPress plugin is exploited in the wild. Patch, hunt for shells, and harden admin access.

  • A maximum-severity unauthenticated remote code execution flaw (CVSS 10.0) in the Bricksforge WordPress plugin, tracked as CVE-2026-85097, is under active exploitation according to Patchstack.
  • Any school, district or government website running an unpatched Bricksforge plugin is exposed; WordPress is widely used for K-12 and public-sector sites.
  • Successful exploitation allows arbitrary file upload and code execution, leading to full site takeover, web shells, data theft and a pivot point into district networks.

What to do now

  1. Inventory every WordPress site and confirm whether Bricksforge is installed and at what version; update to the latest patched release immediately, or deactivate and remove the plugin if no fix exists yet.
  2. Hunt for compromise: recently modified or uploaded PHP files in uploads and plugin directories, unauthorized administrator accounts, suspicious scheduled tasks and web shells, plus anomalous POST requests to plugin endpoints in web server logs.
  3. Deploy WAF virtual patching rules for CVE-2026-85097 and block exploitation attempts at the edge while patching is completed.
  4. Rotate credentials, API keys and WordPress salts for any affected site, and restore from a known-clean backup if a shell or unauthorized access is found.
  5. Enforce MFA and least privilege on all WordPress admin accounts, and subscribe to Patchstack, Wordfence and vendor advisories for updated guidance.

Related items