Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

1. Executive summary

Attackers are actively exploiting CVE-2026-85097, a maximum-severity flaw in the Bricksforge plugin for WordPress that lets an unauthenticated attacker upload and execute arbitrary PHP code, achieving remote code execution. The verified NVD record scores the flaw CVSS 9.8 CRITICAL under CWE-434 (Unrestricted Upload of File with Dangerous Type); the source reports a CVSS of 10.0, a discrepancy noted in §3. The flaw is not in CISA KEV and carries an EPSS of 0%, so exploitation is currently driven by opportunistic scanning rather than a weaponised, widely-tracked campaign. Any EMEA financial services firm running Bricksforge on an internet-facing WordPress site is exposed to full site and underlying-host compromise without authentication. The immediate action is to identify Bricksforge installations, confirm the fixed version, and treat any unpatched, internet-facing instance as compromised until proven otherwise.

2. Regulatory framing

No DORA Art. 19 or NIS2 Art. 23 reporting obligation is engaged by this item alone; those attach only once a firm confirms a major incident on its own estate. The three rows above are engaged because the trigger is a specific, exploitable third-party component on a public-facing system, not because "an incident occurred".

3. Technical analysis & attack chain

The source material is thin: the primary item is a short news brief and does not publish a step-by-step exploit chain, payload details, or post-exploitation behaviour. The following is what can be stated from the sources without fabrication.

Confirmed facts:

1. CVE-2026-85097 affects the Bricksforge plugin for WordPress.
2. The flaw allows an unauthenticated attacker to upload and execute arbitrary PHP code on a vulnerable WordPress site, resulting in remote code execution.
3. The flaw is under active exploitation in the wild, per Patchstack (single source).
4. The verified NVD record classifies the flaw as CWE-434, Unrestricted Upload of File with Dangerous Type, CVSS 9.8 CRITICAL.

Vulnerability mechanism. CWE-434 describes an upload handler that accepts a file of a dangerous type (here, PHP) without adequate validation, so the uploaded file is stored and then executed by the web server. The source does not name the specific Bricksforge endpoint, parameter, or file path involved, and none should be assumed. The practical consequence is that an attacker who reaches the vulnerable upload path can place a PHP file on the server and trigger its execution, giving code execution in the context of the web server user.

Discrepancy. The source reports CVSS 10.0; the verified NVD record gives CVSS 9.8 CRITICAL. Both describe the same unauthenticated RCE; the verified value is used throughout this advisory. The CWE is stated as CWE-434 in the verified data.

Attack chain. Only the initial-access step is confirmed by the sources: unauthenticated upload of a PHP file to a vulnerable Bricksforge endpoint, followed by execution. The sources do not describe persistence, privilege escalation, command-and-control, lateral movement, or data exfiltration for this specific CVE. Those stages should not be assumed from the generic pattern of WordPress plugin RCEs; they are not in the source material.

Confidence caveat. The active-exploitation claim rests on a single source (Patchstack, via The Hacker News). The CVE is not in CISA KEV and EPSS is 0%, which is consistent with early, opportunistic exploitation rather than a mature campaign. Treat the exploitation status as single-sourced and verify against your own telemetry before acting on it as established fact.

Related WordPress plugin RCEs in the corpus (CVE-2026-87902, CVE-2026-15748, CVE-2026-32475, CVE-2026-63030) are separate vulnerabilities in separate components and are not part of this item's attack chain. They are noted only because they show the same class of flaw recurring across the WordPress plugin ecosystem.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every internet-facing WordPress site and determine which run Bricksforge. The source does not give an affected or fixed version number, so confirm the fixed release with the vendor (Bricksforge) before relying on a version pin.
• For any Bricksforge instance that cannot be confirmed patched, disable the plugin until it is updated. Deactivating the plugin removes the vulnerable upload path.
• Treat any unpatched, internet-facing Bricksforge instance as potentially compromised. Review the web server access and error logs for POST requests to plugin upload endpoints and for subsequent requests to newly written .php files under the WordPress uploads directory (typically wp-content/uploads/).
• Search the uploads directory and the web root for recently created or modified .php files that do not belong to a known plugin or theme.

P2 (within 72 hours)

• Apply the vendor fix to Bricksforge on all remaining instances and verify the running version.
• Where the plugin cannot be updated, place the site behind a WAF rule that blocks PHP file uploads to the plugin's endpoints, and restrict write access to the uploads directory.
• Harden the web server so that PHP execution is disabled in wp-content/uploads/ (for example, deny execution of .php files in that directory at the web server or PHP-FPM level). This limits the impact of any future upload-type flaw, not just this one.

P3 (within 7 days)

• Add Bricksforge and other WordPress plugins to the routine patch cycle with an owner and a cadence, so plugin updates are tracked like any other third-party component.
• Confirm that file integrity monitoring covers the WordPress web root and uploads directory, alerting on new .php files.

5. Indicators of compromise

No indicators of compromise available in the source material. The primary item and the related sources provide no hashes, domains, IP addresses, file paths, or filenames tied to CVE-2026-85097 exploitation.

Behavioural indicators

These are behavioural indicators derived from the flaw class, not atomic indicators from the source. They are not machine-pivotable and are not included in a copyable block.

6. Detection

The sources contain no distinctive strings, command-line flags, filenames, registry keys, or hard-coded values tied to this CVE. The only artefacts available are the CVE identifier and product name, which are not threat artefacts and must not be used as detection strings.

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, "Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE", https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html, 2026-10-12.
• The Hacker News, "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure", https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html (related context).
• The Hacker News, "Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads", https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html (related context).
• ANSSI France CERT, "Vulnérabilité dans WordPress", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1018/ (related context).
• BSI Germany, "WordPress: Schwachstelle ermöglicht Codeausführung", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2822 (related context).
• The Hacker News, "Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code", https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html (related context).
• Rapid7, "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core", https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core (related context).

8. Adverse Trace position

Adverse Trace assesses CVE-2026-85097 as CVSS 9.8 CRITICAL (verified NVD value; the source's 10.0 is noted but not used), not in CISA KEV, EPSS 0%. The exploitation claim is single-sourced to Patchstack and should be verified against client telemetry before it is treated as established. The client impact is concentrated in firms running Bricksforge on internet-facing WordPress sites, where the flaw gives unauthenticated code execution with no user interaction. We will track the CVE for KEV and EPSS movement, confirm the fixed Bricksforge version with the vendor, and re-issue this advisory if a public exploit or atomic indicators appear. Clients should confirm their Bricksforge exposure and patch status to Adverse Trace within 24 hours.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.