Critical Bricksforge WordPress flaw is already under attack
Patchstack logged automated attacks starting Oct. 7 against the plugin; the flaw lets anyone upload files without an account, and a fix exists.
Security firm Patchstack reported that CVE-2026-85097, a flaw in the Bricksforge plugin for WordPress, is already being exploited. In its Oct. 8 advisory, the company says its telemetry logged the first attempts on Oct. 7 at 21:47 UTC, before the advisory went public.
Bricksforge is a commercial plugin that extends the Bricks Builder site constructor. The flaw allows files to be uploaded without logging in, which can lead to remote code execution on the server. Patchstack rates it 10.0 on the CVSS scale; SecurityWeek lists 9.8. The score from the official CVE record is still missing.
| Item | Detail |
|---|---|
| Product | Bricksforge plugin for WordPress |
| Affected versions | 3.1.8.9 and earlier, per Patchstack |
| Fix | 3.1.8.10, per Patchstack |
| Attacks observed | 63 distinct IP addresses |
| Sites using the plugin | About 6 000, per SecurityWeek |
The fixed version is disputed. The Bricksforge changelog does not list a 3.1.8.10. It records, for version 4.0.1 of Oct. 8, a security fix in the Pro Forms module that affects file uploads, without citing the CVE. It is not confirmed that both references describe the same patch, and the vendor has not published an advisory that settles it.
Patchstack describes the attacks as automated and run over rotating infrastructure, and says those patterns do not point to a single actor. Six of the 63 addresses produced about 46% of the requests. All of the exploitation data comes from Patchstack itself, which sells protection against this kind of flaw, and SecurityWeek repeats it without a separate check.
For anyone running a site with Bricksforge, including agencies and shops in Mexico that use Bricks, Patchstack recommends updating and checking logs and upload directories for unexpected PHP files, because an update does not remove what an attacker may have already placed. Whether any sites were actually compromised remains unanswered: the sources describe attempts.
