Critical Bricksforge WordPress Plugin Flaw Under Attack
A severe security flaw affecting the commercial Bricksforge add-on for WordPress has come under active attack, prompting urgent calls for remediation across roughly 6,000 targeted websites.
Radwan AbdulhadiEditor and technology writer
Overview of the Critical Vulnerability
A critical vulnerability residing in the Bricksforge WordPress plugin is currently facing active exploitation by malicious threat actors in the wild, according to findings from WordPress security company Patchstack. Tracked under the identifier CVE-2026-85097, the security hole carries a maximum CVSS severity score of 9.8. Unauthenticated attackers can leverage this weakness to upload arbitrary files and execute arbitrary malicious code on vulnerable systems. Such capabilities ultimately grant threat actors full administrative control over targeted WordPress websites.
Scope, Impact, and Affected Versions
Bricksforge serves as a commercial add-on designed for the Bricks visual site builder, equipping WordPress administrators with supplemental tools such as custom forms, advanced animations, an email designer, and dedicated admin-area pages. Data compiled by Patchstack indicates that the plugin is utilized by approximately 6,000 active websites. Versions 3.1.8.9 and all earlier iterations contain the flaw and remain vulnerable until updated. The developers addressed and resolved the security hole with the official release of version 3.1.8.10, making immediate patching essential for all site administrators.
Telemetry and Automated Attack Patterns
Patchstack security researchers first began detecting in-the-wild exploitation attempts targeting the Bricksforge plugin on October 7. Telemetry data captured by the security firm highlighted two distinct clusters of malicious activity. In the first observed pattern, 44 unique IP addresses transmitted 56 requests containing identical payloads within a matter of seconds. In the second cluster, three distinct IPs systematically tested 25 variations of PHP extensions and encodings against the exact same temporary file.
According to the security company, both operational patterns point directly to automated exploitation campaigns executed over rotating proxies or distributed infrastructure. Researchers noted that these patterns do not, on their own, definitively attribute the malicious activity to a single unified threat actor or advanced persistent threat group.
Broader Context in WordPress Security
The rapid operationalization of newly discovered exploits is part of a broader trend across the cybersecurity landscape, where malicious actors frequently target WordPress vulnerabilities shortly after patches are made public. This persistent threat ecosystem regularly involves both third-party plugin flaws and core security weaknesses affecting WordPress itself.
Site administrators and web hosting providers are continually urged to monitor third-party component inventories and apply available security updates promptly to mitigate risks associated with remote code execution and full site takeovers.
Sources
- SecurityWeekBricksforge WordPress Plugin Vulnerability Exploited in the Wild
Continue chronologically
Related stories
Ninja Forms and WooCommerce Plugins Hit by Exploitation Campaign
Hackers are actively exploiting high-severity stored XSS vulnerabilities in WordPress plugins Ninja Forms and WPC Product Bundles to compromise sites.
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
A security breach at TeamUpdraft exposed UpdraftCentral connection keys, leading to active backdoor attacks and unauthorized administrator accounts on WordPress websites.
Critical PHP Vulnerabilities Threaten Websites Worldwide
Security patches roll out for two critical PHP vulnerabilities rated 9.2, impacting millions of sites and prompting warnings from cybersecurity agencies.
Fresh WordPress Vulnerability Targeted by Attackers
Threat actors are actively targeting a high-severity unauthenticated race condition vulnerability in WordPress leading to remote code execution.
