Attackers exploit Bricksforge flaw to take over WordPress websites
The vulnerability, tracked as CVE-2026-85097, can give attackers control of affected WordPress sites. According to The Hacker News, it has a maximum CVSS score of 10.0 and lets attackers upload and execute arbitrary PHP code without authentication. The outlet cited Patchstack as the source of the active-exploitation finding.
Covered by 2 publishers within 4 hours of the first report.
Reporting2
The Hacker News Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE · info@thehackernews.com (The Hacker News)
SecurityWeek Bricksforge WordPress Plugin Vulnerability Exploited in the Wild · Eduard Kovacs