A WordPress add-on let strangers upload code. Attacks started on 7 October.
By Lior AharonovFounder, 7IT Solutions ·
Patchstack says attackers are exploiting CVE-2026-85097, an unauthenticated arbitrary file upload flaw rated CVSS 9.8 in Bricksforge, a commercial add-on for the Bricks site builder, SecurityWeek reported on Monday 12 October 2026. Versions 3.1.8.9 and earlier are affected, and 3.1.8.10 fixes it. Patchstack saw in-the-wild attempts from 7 October.
Your marketing site runs on WordPress, built by an agency years ago. Upload a file, run code, own the site: the forms, the tracking scripts, the login page your customers trust. Patchstack counts roughly 6,000 sites using the add-on.
If your site or a client's uses Bricks with Bricksforge, update Bricksforge to 3.1.8.10 today and check the uploads folder for PHP files you did not put there.
The plugin you forgot you installed is the one attackers remember. Keep a list of what runs on your WordPress, theme and plugins alike.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.