Our takeCVE-2026-85097 (CVSS 10.0) in the Bricksforge WordPress plugin is under active exploitation; unauthenticated RCE via arbitrary PHP upload. Update to 3.1.9.0 immediately if you run it yourself.Cyber Resilience desk
Sources (3)
- hackernews · hackernews
- securityweek · securityweek
- the420_in · the420_in
What this means for you — Security leader:Update all Bricksforge instances to 3.1.9.0 or later immediately; the unauthenticated RCE (CVE-2026-85097) is under active exploitation.
What this means for you — Lean IT orgs:If you run a WordPress site with the Bricksforge plugin, update it to version 3.1.9.0 or newer right away. Most teams without this plugin can ignore this.
What this means for you — MSP:Scan client WordPress estates for Bricksforge ≤ 3.1.8.9 and push the 3.1.9.0 update; CVE-2026-85097 is already being exploited in the wild.
What this means for you — Researcher:CVE-2026-85097 (CVSS 10.0) in Bricksforge ≤ 3.1.8.9 enables unauthenticated PHP file upload and RCE; confirmed in-the-wild exploitation.