Tia N.List

Reported by 5 outlets

CVE-2026-85097 Bricksforge WordPress Plugin Critical RCE

hot7.1
Why this score
Breadth
2.00 / 2.0 · 5 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
4.90 / 5.0 · CVSS + content signals
Velocity
2.00 / 2.0 · updates in 48h
Pickup speed
0.59 / 0.6 · time to second source
Recency
× 0.63 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
7.1 / 10 = base × recency + community
radar.offseq.comthehackernews.compatchstack.combeyondmachines.netsecurityweek.com CVE-2026-85097 desk first seen 1d ago

Desk analysis

CVE-2026-85097 is a critical unauthenticated file upload leading to remote code execution in the Bricksforge WordPress plugin (CVSS 10.0 per Patchstack). Exploitation has been observed since October 7 from 63 IPs. The vulnerability allows unauthenticated attackers to upload arbitrary files. Administrators using Bricksforge should patch immediately and review access logs for indicators of exploitation.

Timeline

  1. original reporting

    CVE-2026-85097 | Bricksforge WordPress plugin https:// radar.offseq.com/threat/bricks forge-wordpress-plugin-vulnerability-exploited-in-the-

    radar.offseq.com · 1d ago · October 12th, 2026

    CVE-2026-85097 | Bricksforge WordPress plugin https:// radar.offseq.com/threat/bricks forge-wordpress-plugin-vulnerability-exploited-in-the-

    via Mastodon https://radar.offseq.com/threat/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild-294d102eaf91b415

  2. original reporting

    🤖 CVE-2026-85097 (CVSS 10.0): unauthenticated RCE in the Bricksforge WordPress plugin — arbitrary PHP file upload and execution. Actively ex

    thehackernews.com · 1d ago · October 12th, 2026

    🤖 CVE-2026-85097 (CVSS 10.0): unauthenticated RCE in the Bricksforge WordPress plugin — arbitrary PHP file upload and execution. Actively ex

    via Mastodon https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html

  3. mentioned by patchstack.com

    Bricksforge (WordPress plugin) CVE-2026-85097, CVSS 10.0 per Patchstack: unauthenticated file upload -> RCE. Exploited since 7/10, 63 IPs.

    patchstack.com · 20h ago · October 13th, 2026

  4. update from beyondmachines.net

    Attackers Exploit Maximum-Severity Bricksforge Flaw to Seize WordPress Sites Bricksforge and several other WordPress plugins are actively ex

    beyondmachines.net · 18h ago · October 13th, 2026

    Attackers Exploit Maximum-Severity Bricksforge Flaw to Seize WordPress Sites Bricksforge and several other WordPress plugins are actively ex

    via Mastodon https://beyondmachines.net/event_details/attackers-exploit-maximum-severity-bricksforge-flaw-to-seize-wordpress-sites-b-p-v-k-i/gD2P6Ple2L

  5. update from securityweek.com

    Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

    securityweek.com · 17h ago · October 13th, 2026

    submitted by /u/NISMO1968 [link] [comments]

    via reddit r/cybersecurity: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Covered in

digest 2026-10-13

Source on GitHub