Bricksforge WordPress plugin flaw CVE-2026-85097 exploited in the wild

What happened

Patchstack says attackers are targeting CVE-2026-85097 in Bricksforge. Bricksforge is a commercial add-on for the Bricks Builder site builder on WordPress. The flaw lets anyone upload and run PHP code on a vulnerable site.

Wordfence published the CVE on 8 October 2026 as the CNA. Patchstack first saw attack traffic on 7 October 2026 at 22:47 UTC+1. That was hours before the CVE record went public.

Wordfence's record shows the vendor was notified on 3 September 2026. It credits the researcher d.v4n_s3c.

Who is affected

Bricksforge versions up to and including 3.1.8.9 are affected. No login is needed. The vendor says the issue affects sites with Pro Forms active, even when forms have no upload field.

Bricksforge is a premium plugin, so there is no public install count. SecurityWeek, citing Patchstack, puts usage at roughly 6,000 websites. ThreatWire could not confirm that figure independently.

What is confirmed

Wordfence scores the flaw CVSS 3.1 9.8 (Critical). Patchstack rates it 10.0 (Critical). The weakness is CWE-434, unrestricted file upload. NVD shows the Wordfence score.

The vendor changelog says the CVE was fixed in 3.1.8.10 and 4.0.0. Version 4.0.1, released 8 October, fixed a related Pro Forms upload issue. Version 4.0.2, released 13 October, added more upload and REST endpoint hardening.

Patchstack, a named WordPress threat intelligence firm, reports active exploitation attempts. It recorded 63 source IPs. One cluster of 44 IPs sent 56 identical requests within seconds. Patchstack says the patterns point to automated attacks.

The CVE is not in the CISA KEV catalog. SecurityWeek and The Hacker News reported the attacks, both citing Patchstack.

What is not confirmed

Patchstack reports attempts, not a count of compromised sites. No threat actor has been named. The CISA SSVC entry on NVD still says exploitation: none, from 8 October.

Several GitHub repositories from unvetted accounts claim exploit code for this CVE. ThreatWire did not review or run them and does not link them. It is also not confirmed whether 4.0.1 closed a separate bug or the same one.

What to do

Update Bricksforge to 3.1.8.10 or later on the 3.x line. On 4.x, update to 4.0.2, the latest release. Patchstack says its mitigation rule blocks the attacks for its customers.

Check for signs of compromise. Look for unexpected PHP files in the WordPress uploads folders, including the Bricksforge temporary folder. Review web logs for unusual form submissions to the Bricksforge endpoints.

If you find an unexpected PHP file, treat the site as compromised. Preserve logs, isolate the site and start incident response. The vendor also advises renewing API keys stored in Bricksforge settings as a precaution.

Sources: Wordfence, Patchstack, the Bricksforge changelog, NVD, CVE.org, SecurityWeek and The Hacker News. Links are in the references list.