Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

A critical vulnerability affecting the Bricksforge WordPress plugin has been identified and is currently being exploited in the wild. This issue, tracked as CVE-2026-85097, has a remarkably high severity rating, achieving a CVSS score of 9.8. This situation serves as a severe reminder about the importance of timely plugin updates and website security.

Key Takeaways

• The Bricksforge plugin vulnerability allows unauthenticated attackers to execute arbitrary code.
• This high-severity vulnerability has been actively exploited since October 7, 2023.
• Approximately 6,000 WordPress websites are at risk due to this vulnerability.
• Users are advised to upgrade to version 3.1.8.10 or later to mitigate risks.
• Monitoring and immediate updates are vital to maintaining web security.

Background on Bricksforge

Bricksforge is a commercial add-on designed for the Bricks visual site builder, enhancing WordPress websites with various tools, including custom forms, animations, and an email designer. Despite its beneficial features, the recent discovery of a critical vulnerability poses a significant risk to its users.

Details of the Vulnerability

The vulnerability enables unauthenticated attackers to upload arbitrary files to affected WordPress sites via the Bricksforge plugin. This capability permits the execution of malicious code, which can result in complete control over the compromised websites. This type of vulnerability highlights the dire consequences that can arise from insecure code within WordPress plugins, a consistent threat in the cybersecurity landscape.

Exploitation in the Wild

According to reports from WordPress security company Patchstack, the first attempts to exploit this vulnerability were observed on October 7, 2023. Their telemetry indicates that the exploitation attempts involved at least two distinct patterns: one cluster of 44 IPs generating identical malicious requests within a brief timeframe, and another group of three IPs testing various PHP extensions and encodings on temporary files. This behaviour suggests a systematic and automated approach to exploiting the vulnerability, potentially from multiple threat actors using rotating proxies.

As the exploitation of vulnerabilities shortly after their discovery or patching is a common tactic among cybercriminals, users of the Bricksforge plugin are strongly urged to pay attention to their security practices. Websites running versions 3.1.8.9 or prior are particularly vulnerable and should be updated immediately to the patched version 3.1.8.10 to mitigate the threat.

Mitigation and Remediation

Website owners using the Bricksforge plugin must act quickly to safeguard their sites. Immediate steps include:

1. Update the Plugin: Ensure that your Bricksforge plugin is upgraded to version 3.1.8.10 or higher, where the security hole has been fixed.
2. Monitor Site Activity: Regularly review website logs and user activities for any unusual behaviour that may indicate an attempted breach.
3. Implement Additional Security Measures: Consider employing security plugins that offer enhanced protection against vulnerabilities and actively monitor your WordPress site's security.
4. Regular Backups: Maintain up-to-date backups of your website to ensure quick recovery in case of compromise.

As the landscape of cyber threats continues to evolve, the need for constant vigilance and proactive measures becomes ever more critical. This incident with the Bricksforge plugin serves as a crucial reminder of the risks presented by WordPress plugins, encouraging both developers and users to prioritise security in their digital environments.

Source: securityweek.com