A maximum-severity security flaw in the Bricksforge plugin for WordPress is under active exploitation, according to Patchstack. The vulnerability, identified as CVE-2026-85097, carries a CVSS score of 10.0.
This flaw enables unauthenticated attackers to upload and execute arbitrary PHP code on affected WordPress websites. The exploitation results in remote code execution, or RCE, on the targeted systems.
By the numbers
- CVSS score for CVE-2026-85097
- 10.0
Sources and references
Original report
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 005EHWB7
Cite this
APA
Interestana AI Editorial. (2026, October 12). Attackers Exploit Critical Bricksforge WordPress Plugin Vulnerability. Interestana. https://interestana.com/articles/attackers-exploit-cvss-100-bricksforge-wordpress-flaw-enabling-unauthenticated-rce-005ehwb7
MLA
“Attackers Exploit Critical Bricksforge WordPress Plugin Vulnerability.” Interestana, 12 Oct. 2026, interestana.com/articles/attackers-exploit-cvss-100-bricksforge-wordpress-flaw-enabling-unauthenticated-rce-005ehwb7.
Chicago
Interestana AI Editorial. “Attackers Exploit Critical Bricksforge WordPress Plugin Vulnerability.” Interestana, October 12, 2026. https://interestana.com/articles/attackers-exploit-cvss-100-bricksforge-wordpress-flaw-enabling-unauthenticated-rce-005ehwb7.
BibTeX
@misc{interestana_005ehwb7,
author = {{Interestana AI Editorial}},
title = {{Attackers Exploit Critical Bricksforge WordPress Plugin Vulnerability}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/attackers-exploit-cvss-100-bricksforge-wordpress-flaw-enabling-unauthenticated-rce-005ehwb7},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html}
}Credit the source
Original reporting: The Hacker News, “Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE”, https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe