WordPress Bricksforge Vulnerability Enables Unauthenticated RCE Across Hundreds of Sites

A critical flaw in the Bricksforge plugin for WordPress—identified as CVE-2026-85097 and rated a perfect 10.0 on the Common Vulnerability Scoring System—has been actively exploited since it was disclosed. The bug permits unauthenticated remote code execution (RCE) by allowing an attacker to submit specially crafted HTTP requests that cause the website to fetch and execute arbitrary PHP files without needing valid user credentials or even knowledge of the target’s internal configuration. The vulnerability is now affecting hundreds of websites worldwide, many of which run popular e‑commerce platforms such as WooCommerce.¹

The exploitation process is straightforward: an attacker sends a POST request containing malicious payloads directly to the vulnerable endpoint; because no authentication checks are performed, the server blindly writes the file into its document root and subsequently executes it. This means any visitor can be exposed to data exfiltration, credential theft, or further lateral movement within the site’s infrastructure. In practice, compromised sites could leak customer payment details, personal identifiers, and other sensitive information stored in their databases.