A CVSS 10.0 flaw in the Bricksforge WordPress plugin is being actively exploited, letting attackers run code on your site without logging in. Here's what to do now.
### The 10.0 That Should Make You Nervous
A CVSS score of 10.0 is the highest severity rating a vulnerability can receive. It means one thing: no authentication required, no special conditions, no user interaction. Just a direct path from the open internet into your site's core files.
That's exactly what researchers at Patchstack found in the Bricksforge plugin for WordPress. Tracked as CVE-2026-85097, this flaw allows unauthenticated attackers to upload and execute arbitrary PHP code on any vulnerable WordPress installation. In plain English? Someone on the other side of the world can run their own code on your server, and you might not even know it happened until the damage is done.
This isn't theoretical. It's being exploited in the wild right now.
### Why This One Hits Different
WordPress powers roughly 40% of the web, and plugins are its softest target. Bricksforge is a popular tool for designers building custom sites with the Bricks theme. That popularity is precisely what makes this dangerous.
Here's the uncomfortable part: remote code execution (RCE) is the jackpot for attackers. It's not a data leak or a defacement. It's full control. Once they're in, they can:
- Install persistent backdoors that survive plugin updates
- Redirect your traffic to phishing or malware sites
- Steal customer data, credentials, and payment info
- Use your server as a launchpad for attacks on other sites
- Quietly mine crypto on your hosting resources
And because the exploit requires no login, automated scanners can hit thousands of sites per hour. You don't have to be targeted. You just have to be unlucky enough to be online.
> "The most dangerous vulnerabilities aren't the ones that are hard to exploit. They're the ones that are easy to exploit and easy to ignore."
### What You Should Do Right Now
If you run Bricksforge, stop reading and go check your version. Seriously. This is one of those moments where an hour of hesitation can cost you a business.
- **Update immediately.** Patchstack disclosed the flaw alongside a fix. If your plugin is current, you're likely protected.
- **Check for signs of compromise.** Look for unfamiliar admin accounts, modified core files, or strange outbound traffic.
- **Rotate your credentials.** Change WordPress admin passwords, database passwords, and any API keys stored on the site.
- **Audit your plugins.** Every plugin is a potential door. Remove anything you're not actively using.
- **Consider isolation.** Running risky sites in isolated environments limits the blast radius when something goes wrong.
### The Bigger Lesson Here
This story isn't really about Bricksforge. It's about the fragile assumption most site owners carry: that if a plugin is popular, it must be safe.
Popularity and security are not the same thing. A plugin with a million installs is a plugin with a million potential targets. Attackers don't hunt for obscure software. They hunt for scale.
That's why professionals managing multiple sites, ad accounts, or client properties increasingly layer their defenses. Antidetect browsers, for example, help separate identities and sessions so that one compromised environment doesn't drag everything else down with it. It's not paranoia. It's basic hygiene in a world where a single unpatched plugin can unravel months of work.
The uncomfortable truth is that most breaches aren't sophisticated. They're opportunistic. They exploit the gap between disclosure and action. The fix is already available. The question is whether you'll apply it before someone else does.
### The Bottom Line
CVE-2026-85097 is a 10.0 for a reason. It's fast, it's unauthenticated, and it's already being used against real sites. Patch your plugin, harden your setup, and stop treating updates as optional. In security, speed isn't a virtue. It's the whole game.
