Critical Bricksforge Plugin Flaw Actively Exploited on WordPress

En bref

• CVE-2026-85097 is a critical flaw in the Bricksforge plugin for WordPress.
• Attackers do not need credentials to exploit it.
• Successful attacks allow PHP code upload and execution.
• Patchstack reports active exploitation in October 2026.
• Vulnerable sites face full compromise.

In October 2026, a serious security issue identified as CVE-2026-85097 was disclosed in the Bricksforge plugin for WordPress. According to Patchstack, threat actors are already taking advantage of this bug. The vulnerability permits someone with no account or login to run PHP code on a site that has the affected plugin installed.

Any WordPress site using a vulnerable Bricksforge version is in scope. Since the plugin helps with theme customization, it may be present on many installations. Because the attack requires no authentication, remote scanning and exploitation can happen at scale.

When an attacker succeeds, they can place PHP files on the server and then execute them. This leads to a full website compromise, which might include stolen data, injected malware, or the server being used for other malicious activity. The active exploitation makes patching urgent.

Patchstack and the WordPress community frequently see plugin vulnerabilities targeted soon after disclosure. This CVE carries a critical rating. The lack of an authentication barrier means even low-skilled attackers can attempt it.

Administrators should watch for Bricksforge updates and apply them without delay. If no fix is ready, disabling the plugin is a safer choice. Monitoring for unexpected PHP files and unusual POST requests to plugin endpoints can help detect intrusion attempts. Keeping an eye on Patchstack and WordPress advisories will provide further guidance.

À faire maintenant

1. Immediately update Bricksforge to the latest patched version if one is available.
2. If no patch exists, deactivate and remove the Bricksforge plugin until a fix is released.
3. Deploy WAF rules to block exploit attempts targeting CVE-2026-85097.
4. Scan the file system for recently modified or uploaded PHP files, especially in uploads and plugin directories.
5. Review web server logs for suspicious POST requests or code execution patterns.
6. Reset credentials and secrets for any compromised site, and restore from a clean backup if needed.
7. Subscribe to Patchstack and WordPress security advisories for ongoing updates.

Références CVE

• CVE-2026-85097

Source originale

The Hacker News