A maximum-severity vulnerability in the Bricksforge add-on for the Bricks visual builder is being actively exploited in the wild, according to WordPress security company Patchstack. Tracked as CVE-2026-85097 with a CVSS score of 10.0 — the highest possible — the flaw allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in full remote code execution. It affects Bricksforge versions up to and including 3.1.8.9 (roughly 6,000 sites use the plugin); the fix is in version 3.1.8.10. Patchstack detected the first exploitation attempts on October 7, 2026, at 21:47 UTC, with attack patterns pointing to automated exploitation over rotating proxy infrastructure.
The attack chain is straightforward for criminals: the attacker requests a valid nonce from an exposed AJAX endpoint, uploads a GIF/PHP polyglot file that passes the plugin’s initial MIME check, then manipulates the form submission’s URL field so the payload lands as an executable PHP file. No account on your site is needed. Successful exploitation can lead to web shells, stolen data, modified content, and persistent backdoor access — a complete site takeover.
If your site runs Bricksforge, update to 3.1.8.10 or later immediately, then review your site for signs of compromise (unexpected files, new admin accounts, unfamiliar plugins). Staying ahead of disclosures like this is exactly what Qamar Digital Ventures LLC’s website care plans are built for — timely updates, security monitoring, and expert review whenever a critical flaw goes public.
https://qamardigitalventuresllc.com/
Sources: Patchstack technical analysis; The Hacker News; SecurityWeek.