WordPress
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run WordPress, and which versions?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 1 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-85097- 9.8 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Not listed
- ~3.3% estimated chance of attack in 30 days
- Not linked from the CVE record
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites. The post Bricksforge WordPress Plugin Vulnerability Exploited in the Wild appeared first on SecurityWeek. " " ": "The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites." " ": "Bricksforge WordPress Plugin Vulnerability Exploited in the Wild" This website stores cookies on your computer.
Products and services involved
- WordPress95% match confidence · CVE-2026-85097
Pulse
Last checked 1 Nov · Recheck overdue since 2 Nov 2026, 04:08 UK time · 1 quiet check collapsed
- Story12 Oct 2026, 15:09 UK time · 12 Oct
Linked reporting from SecurityWeek (independent original reporting).
Read source (SecurityWeek) - Signal16 Oct 2026, 04:06 UK time · 16 Oct
in the next 30 days first recorded at 0.3% (lower likelihood signal, not confirmed exploitation).
- Signal1 Nov 2026, 04:08 UK time · 1 Nov
in the next 30 days first recorded at 3.3% (lower likelihood signal, not confirmed exploitation).
3 entries so far. The timeline chart appears once this story has more history.
Sources
- SecurityWeekNews
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9
- ProbableSummary fact75% confidence
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites. The post Bricksforge WordPress Plugin Vulnerability Exploited in the Wild appeared first on SecurityWeek. Bricksforge WordPress Plugin Vulnerability Exploited in the Wild This website stores cookies on your computer.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-85097