Attackers are exploiting a critical flaw (CVE-2026-85097) in the Bricksforge WordPress plugin that lets them run code on a website without logging in. It affects Bricks-built sites running Bricksforge up to version 3.1.8.9. Update today to 3.1.8.10 or later and check whether your site was compromised since 7 October.
Key facts
- CVE-2026-85097 has a CVSS score of 10.0 according to The Hacker News and 9.8 according to SecurityWeek. Both agree it is critical and requires no authentication.
- It affects Bricksforge up to and including 3.1.8.9. The fix arrived in 3.1.8.10, and The Hacker News recommends the latest version, 4.0.1.
- Patchstack detected the first exploitation attempts on 7 October 2026 at 21:47 UTC.
- Bricksforge is a commercial add-on for the Bricks visual builder. Patchstack puts it at around 6,000 websites.
- Patchstack logged clusters of 44 IPs sending 56 requests with identical payloads, a pattern of automated exploitation.
Am I affected if my site runs on WordPress?
Only if your site uses the Bricks builder and also has Bricksforge installed. Running WordPress on its own does not expose you to this flaw.
The catch is that many companies don't know which plugins their site uses. If an agency or freelancer built it, you have probably never checked. Your corporate site, online shop or campaign landing page could all be affected.
What can an attacker do with this?
According to The Hacker News, the attack requests a nonce from an AJAX endpoint that requires no authentication and uploads a polyglot file that is both GIF and PHP. It then submits a form whose URL ends in a PHP extension. Bricksforge trusts that metadata and executes the code when the file is requested.
The result is control of the website: the attacker can deploy web shells, read sensitive data and keep persistent access. If your site stores contact forms, orders or customer accounts, that includes personal data.
The patterns Patchstack saw point to rotating proxies or distributed infrastructure. Nobody is picking targets: everything running the plugin is being scanned.
What to do today
- Log in to your WordPress dashboard and check the plugin list. Look for Bricksforge.
- If it's there, update it to 3.1.8.10 or later. Ideally 4.0.1, the latest version cited by The Hacker News.
- If you can't update right now, deactivate the plugin until you can.
- Review your server logs. Look for requests to
/wp-json/bricksforge/v1/form_submitcarrying thetemporaryFileUploadsparameter, and for repeated form submissions. - Look for unexpected PHP files in
/wp-content/uploads/bricksforge/tmp/. - If you find anything suspicious, change administrator credentials and database keys.
- Message whoever maintains your site today and ask which plugins it uses and who updates them.
What it means for a small business
Updating is not enough. Attacks started on 7 October and the patch already existed, but many sites don't update themselves. If your site ran a vulnerable version during these days, assume it may have been compromised and check the logs.
The plugin being on only around 6,000 sites is no comfort. With automated exploitation, company size doesn't matter: the scanner doesn't know who you are.
The underlying failure is usually organisational. The site is commissioned from an agency, delivered, and nobody is left in charge of plugins. If your maintenance contract doesn't say who applies security updates and how quickly, today is a good day to write it down. If nobody on your side can review logs or clean up a compromised site, line up external cybersecurity support before you need it urgently.
An honest note: we were unable to consult Patchstack's original advisory. The data comes from two specialist outlets that cite it, and they differ on the CVSS score. The advice doesn't change.
Frequently asked questions
Is updating Bricksforge enough?
No. The update closes the door, but if someone got in earlier they may have left a web shell or persistent access. Review the logs and the Bricksforge tmp folder.
Why are there two different CVSS scores?
The Hacker News gives 10.0 and SecurityWeek 9.8. Both sit in the top band: the flaw is critical and exploitable without authentication.
Do I have to report anything if I was attacked?
A compromised website can amount to a personal data breach. If so, GDPR may require you to notify it.
