Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

What the source reports

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

This dispatch is based on reporting from The Hacker News. The original publication should be read for the complete context, named sources, dates, and qualifications.

Why it matters

The development is relevant to the way technology is built, secured, governed, or used. Readers should distinguish the reported facts from any interpretation added during editorial review.

The original source remains the authority for the underlying report.

OnBytr’s role is to provide a concise, source-linked explanation and identify the practical question worth watching next. This post is an editorial summary, not a substitute for the original reporting.