Organisations Urged to Patch Bricksforge 3.1.8.10 Amid Wild Exploitation of Critical RCE Vulnerability

Organizations relying on the Bricksforge plugin for WordPress face immediate operational risk from active exploitation of a critical security flaw. The vulnerability enables attackers to execute arbitrary code on web servers without authentication, threatening data integrity and service continuity. This event highlights the ongoing risks associated with third-party plugins, similar to other recent WordPress plugin vulnerabilities reported in the industry.

The risk

Patchstack confirmed that attackers are actively exploiting CVE-2026-85097 in the wild. The flaw carries a maximum CVSS score of 10.0, indicating severe potential impact. Unauthenticated attackers can upload and execute PHP code, resulting in remote code execution. This allows them to take full control of vulnerable WordPress installations, install web shells, or exfiltrate sensitive data.

Who is exposed

The vulnerability affects Bricksforge versions up to and including 3.1.8.9. Bricksforge is a plugin that adds advanced forms, animations, and dynamic data tools to the Bricks visual website builder. Organizations using these older versions are exposed until they upgrade to the patched release, version 3.1.8.10. The attack targets the form submission process specifically.

Cost and compliance

Patchstack first observed exploitation attempts on October 7, 2026, at 9:47 p.m. UTC. The security firm recorded 63 source IP addresses involved in these attacks. Most attempts targeted the /wp-json/bricksforge/v1/form_submit endpoint. Attackers used various file extensions, including .php5, .php8, and .phtml, to bypass detection. Some attempts tried to place files outside the temporary directory.

What happens next

Managers should verify the Bricksforge version on all WordPress installations immediately. If any site runs version 3.1.8.9 or earlier, update to 3.1.8.10 without delay. Review server logs for suspicious activity on form submission endpoints, particularly unusual file uploads or requests containing PHP extensions. Monitor for unauthorized changes to website content or new admin accounts.

Questions to ask your suppliers

Teams should ask vendors whether their managed WordPress sites use the Bricksforge plugin and what version is currently installed. Inquire about the process for emergency patching and how quickly security updates are applied after release. Confirm whether the supplier monitors for exploitation attempts in real time and how they communicate critical alerts. Ensure the supplier can provide evidence of recent security audits for file upload handling.

What to do and how to stay safe: Bricksforge

• Check your WordPress plugin list for Bricksforge and verify the installed version against the fixed release.
• Update to version 3.1.8.10 or later as soon as possible to mitigate the remote code execution risk.
• Review web server logs for unusual activity on form submission endpoints or unexpected file uploads.
• Monitor for signs of compromise, such as new admin users, modified files, or outbound traffic to unknown IPs.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85097?

It is a critical vulnerability in the Bricksforge WordPress plugin that allows unauthenticated remote code execution.

Which Bricksforge versions are affected?

Versions up to and including 3.1.8.9 are vulnerable; version 3.1.8.10 contains the fix.

Is the flaw being exploited?

Yes, Patchstack confirmed active exploitation of the flaw in the wild starting on October 7, 2026.