Vulnerabilities
Bricksforge WordPress Plugin CVE-2026-85097 Exploited: Immediate Update Required
A critical unauthenticated remote code execution flaw (CVE‑2026‑85097) in Bricksforge plugin (versions ≤3.1.8.9) has been actively exploited, allowing attackers to upload arbitrary files and take full control of WordPress sites. The issue is fixed in 3.1.8.10. Defenders must update immediately, monitor for malicious uploads, and block suspicious IPs.
What happened
Patchstack detected active exploitation of a critical RCE flaw (CVE‑2026‑85097) in the Bricksforge WordPress plugin. Unauthenticated attackers can upload arbitrary files and execute code, giving full site control.
Affected
All Bricksforge installations on WordPress sites running version 3.1.8.9 or earlier are vulnerable. The plugin is used by roughly 6,000 sites worldwide.
Impact
Exploit allows attackers to place web shells, modify site content, steal data, and pivot to other systems. The CVSS score is 9.8 (critical).
Patchstack noted that 44 IPs sent 56 identical payloads within seconds of each other, indicating coordinated attacks.
Mitigation
Update Bricksforge to 3.1.8.10 or later. If upgrade is not immediately possible, restrict file uploads, monitor the uploads directory for unexpected files, and block the IPs identified by Patchstack. Verify that no unauthorized files exist in wp-content/uploads or plugin directories.
Related vulnerabilities
CISA Adds WordPress Remote File Inclusion CVE-2026-87902 to KEV Catalog
CISA has added CVE-2026-87902, a WordPress Core Remote File Inclusion flaw, to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. Federal agencies must prioritize patching, and all organizations should treat the vulnerability as high risk and follow remediation guidance.
Read briefing
WordPress CVE-2026-87902 Exploitation: Attackers Writing Malicious Files to Disk
WordPress sites vulnerable to CVE‑2026‑87902 are now being exploited to write arbitrary files that execute shell commands. The flaw, a path‑traversal bug in get_page_template(), allows unauthenticated attackers to achieve remote code execution under specific conditions. Defenders should patch to 7.1.2 or later, verify file integrity, and monitor for suspicious file writes.
Read briefing
Critical WordPress Path Traversal Vulnerability (CVE-2026-87902) Under Active Exploitation
A critical path traversal vulnerability in WordPress, tracked as CVE-2026-87902 with a CVSS score of 9.2, is being actively exploited in the wild shortly after disclosure. Unauthenticated attackers can leverage this flaw for remote code execution under specific server and theme conditions. SecOps and sysadmins must immediately audit active themes and apply official patches.
Read briefing
CVE-2026-12345: CPython Data Integrity Vulnerability – Immediate Patch Required
A critical data‑integrity flaw (CVE‑2026‑12345) was disclosed in CPython, allowing attackers to corrupt program state. Systems running unpatched CPython versions are at risk. Apply the PSF‑2026‑42 patch and verify the update immediately.
Read briefing