Hackers Are Breaking Into WordPress Sites Through a Bricksforge Plugin Flaw

Key points - A critical flaw in the Bricksforge plugin for WordPress, tracked as CVE-2026-85097, is being exploited in the wild as of October 2026. - The bug affects every version of Bricksforge up to and including 3.1.8.9, and site owners need to update immediately. - Attackers don't need a password or account: anyone on the internet can trigger it. - A successful attack lets the hacker run their own PHP code on the site, which in practice means full takeover. - The flaw sits in how the plugin handles temporary file uploads during form submissions.

A popular WordPress add-on called Bricksforge has a security hole serious enough that strangers on the internet can take over a website running it. Patchstack, the security firm that found it, says the flaw is being used in real attacks right now, as reported by The Hacker News.

CVE-2026-85097 carries a severity score of 10.0 out of 10 on the official record at the US National Vulnerability Database. It affects every version of the plugin up to and including 3.1.8.9. If your site runs Bricksforge, treat this as a drop-everything update. We've covered similar no-authentication, file-upload attacks twice in September alone, including a WooCommerce flaw that drew more than 100,000 exploit attempts before most owners had patched.

What does the flaw actually let attackers do?

It lets a stranger upload a file to your website and then run it as code. In WordPress terms, that's as bad as it gets. An attacker ends up able to read your database, change pages, plant backdoors or redirect visitors.

Bricksforge lets site visitors upload files through forms, and it correctly checks that uploaded files are the type they claim to be, so you can't just upload a PHP script and call it an image. PHP is the programming language WordPress is built on, and running attacker-supplied PHP is what gives full control.

Getting around that check takes two steps. First, the attacker calls a public endpoint on the site, bricksforge_regenerate_nonce, to collect a valid security token. Then they upload a file that is simultaneously a valid GIF image and a working PHP script, a technique known as a polyglot. The plugin sees the GIF portion and lets it through.

Where Bricksforge fails is what happens next. When the form is submitted, it reads a separate url field supplied by the attacker and uses that field's file extension to decide how to treat the stored file. Set that field to end in .php and the server runs the harmless-looking GIF as executable code.

Who is at risk?

Any WordPress site with Bricksforge installed and not yet updated past version 3.1.8.9. Bricksforge is an add-on for the Bricks site builder, popular with freelance web designers and small agencies. Many of the exposed sites belong to small businesses that don't monitor security advisories closely.

What should site owners do right now?

Update the Bricksforge plugin to the latest version through the WordPress admin dashboard today. If you can't update immediately, deactivate the plugin until you can.

After updating, check for signs that someone already got in. Look in the WordPress uploads directory for .php files you didn't put there, and check for new administrator accounts you don't recognise. If anything looks off, assume the site is compromised, restore from a backup predating early October, then update before bringing it back online.

Should you worry about data exposure?

Unauthenticated code execution gives access to the whole database, so any personal data collected through Bricksforge forms, names, emails, phone numbers submitted by visitors, could have been read. UK and EU site owners should check whether a reportable breach has occurred under their data protection obligations. US operators should review state breach-notification law and, for commercial sites, FTC guidance on consumer data.