Active Bricksforge Attacks Enable WordPress Site Takeover

Attackers are actively exploiting CVE-2026-85097, a critical CVSS 10.0 vulnerability affecting Bricksforge versions through 3.1.8.9. The flaw lets unauthenticated attackers manipulate uploaded-file metadata to place and execute arbitrary PHP files, enabling web shells, data theft, persistence, and complete WordPress site takeover. Patchstack observed automated exploitation from 63 IP addresses, including attempts using alternative and encoded PHP extensions to bypass filtering. Site owners should upgrade to Bricksforge 4.0.1, inspect submission endpoints for malicious temporaryFileUploads requests, and search the plugin’s temporary directory for unexpected PHP files.

Reference: thehackernews.com