Critical Unauthenticated RCE in Bricksforge WordPress Plugin (CVE‑2026‑85097) Threatens Millions of Sites
What It Is – A newly disclosed vulnerability (CVE‑2026‑85097) in the Bricksforge page‑builder plugin for WordPress allows an unauthenticated attacker to upload arbitrary PHP files and achieve remote code execution.
Exploitability – The flaw is being actively exploited in the wild; proof‑of‑concept exploits have been published. CVSS 3.1 base score 10.0 (critical).
Affected Products – Bricksforge plugin versions 1.0‑2.4 for WordPress (any site that has the plugin installed).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that capture third‑party component risk in real time.
- Provides evidence that an organization’s patch‑management process is auditable – a key control for proving due‑diligence to regulators and enterprise buyers.
- Highlights the importance of continuous monitoring of external assets (plugins, libraries) to maintain a defensible security posture.
Recommended Actions
- Identify all WordPress sites running the Bricksforge plugin and inventory their versions.
- Apply the vendor‑released patch or remove the plugin immediately.
- Run an automated web‑application scan to verify remediation and detect any lingering malicious files.
- Update your vulnerability‑management workflow to include third‑party plugin monitoring and evidence collection for audit trails.
Source: The Hacker News