Patchstack reported that a 10.0 bug in the Bricksforge plugin for WordPress was exploited in the wild.
The flaw — CVE-2026-85097 — results in remote code execution (RCE) when unauthenticated attackers upload and execute arbitrary PHP code on vulnerable WordPress sites.
Security pros were concerned about this flaw because Bricksforge described it as a “Swiss Army Knife” for Bricks, the WordPress visual website building tool.
Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs, said teams need to treat these type of WordPress plugins as third-party software dependencies, not website decoration.
Krell said Bricksforge operates as a paid site-builder add-on, but it runs with the same access as the site, and attackers are already exploiting a flaw that requires no WordPress login.
Related reading:
“CVE-2026-85097 affects Bricksforge’s Pro Forms module through version 3.1.8.9,” said Krell. “In simple terms, anyone can upload a file that looks like an image and trick the plugin into running it as PHP code. That is RCE, the point where a file-upload bug becomes the ability to make the website execute an attacker’s commands. From there, the attacker can change the site, access data available to WordPress, or leave behind access for later.”
Jason Soroko, senior fellow at Sectigo, said that a plugin does not need to be widely known to expose a valuable website. Soroko said this flaw lets someone without a login run code on an affected site, potentially read sensitive data, change pages, and leave a backdoor.
Soroko said the underlying mistake is trusting information supplied by the visitor after checking the uploaded file: an image passes inspection, but a later form submission makes the plugin save its contents as executable PHP, which gives an attacker access well beyond the form itself.
“I'd verify the version and upgrade to 3.1.8.10 or 4.0.1 immediately,” said Soroko. “Longer term, every WordPress site should have a software bill of materials that lists its plugins and versions, with third-party risk assessments for add-ons that upload files, handle form data, or connect to other services.
Soroko said teams should also search wp-content/uploads/bricksforge/tmp for unexpected PHP files and review Bricksforge form-submission logs. Bricksforge sits outside the wordpress.org plugin directory, but it still has production-level access to the site, said Soroko.
