Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

According to Patchstack, attackers are actively exploiting the critical Bricksforge WordPress plugin vulnerability CVE-2026-85097 in the wild. The flaw allows unauthenticated attackers to upload and execute arbitrary PHP code, resulting in remote code execution on the server. Bricksforge versions up to and including 3.1.8.9 are affected; the source states that fixes were released in version 3.1.8.10 and advises users to update to the latest version, identified as 4.0.1.