Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Patchstack has detected active exploitation of a critical flaw in Bricksforge, a commercial add-on used by around 6,000 WordPress sites running the Bricks builder. Tracked as CVE-2026-85097 with a CVSS score of 9.8, the bug lets unauthenticated attackers upload arbitrary files and run malicious code, potentially leading to complete compromise of affected websites. The issue affects versions up to and including 3.1.8.9 and was fixed in version 3.1.8.10. Patchstack says it began observing in-the-wild attack attempts on October 7, with telemetry showing two distinct clusters of automated requests, one involving dozens of IPs firing identical payloads and another testing multiple file-extension and encoding variations, suggesting coordinated but not necessarily single-actor automated scanning.