Bricksforge Plugin Vulnerability Used to Hijack WordPress Sites

How the Exploit Works and Why It Matters

A critical flaw in the Bricksforge WordPress plugin, identified as CVE‑2026‑85097, is already being exploited in the wild. The attack allows cybercriminals to gain full control over compromised WordPress installations. Security researchers reported the first evidence of exploitation on October 12, 2026, and confirmed that the vulnerability is actively used to take over targeted websites.

The flaw lies in Bricksforge’s handling of user input during the rendering of custom blocks. Attackers can inject malicious code that bypasses the plugin’s sanitisation routines, leading to remote code execution. Once the attacker gains a foothold, they can install backdoors, modify site content, or use the server as a launchpad for further attacks. The vulnerability affects all versions of the plugin released before the latest patch, which was issued on September 30, 2026.

What Should Site Owners Do Right Now?

The exploitation process begins when a malicious actor submits a specially crafted request to a WordPress site that has Bricksforge installed. The plugin’s rendering engine fails to validate the input correctly, allowing the attacker’s code to run with the same privileges as the web server. Because WordPress typically runs with broad permissions, the attacker can alter files, create new admin accounts, and exfiltrate data. Security analysts have observed that the attackers often target sites with high traffic or valuable content, as these provide greater rewards for the intrusion.

Bricksforge is a popular page‑builder plugin used by thousands of sites worldwide. Its widespread adoption means that the potential impact of this vulnerability is significant. Even though the plugin’s developers released a patch weeks earlier, many site owners have yet to update their installations. The delay in patch adoption gives attackers a window of opportunity to compromise vulnerable sites before they are secured.

How Will the Security Community Respond?

Site administrators should immediately verify whether Bricksforge is installed and, if so, check the version number. Upgrading to the latest release, which removes the vulnerable code path, is the only proven defense. In addition, site owners should review user accounts for unauthorized additions, scan for unfamiliar files in the wp-content directory, and monitor server logs for unusual activity. If a site has been compromised, a full forensic review is recommended to ensure that all backdoors are removed.

Security firms have issued a warning that the exploit is being used in targeted campaigns. The attackers are not indiscriminate; they focus on sites with valuable content, e-commerce functionality, or high traffic. This selective approach suggests a profit‑driven motive rather than random vandalism. Consequently, sites that host sensitive user data or financial transactions are especially at risk.

Frequently Asked Questions

The discovery of this vulnerability has prompted a coordinated response from the WordPress security team. They have released a comprehensive advisory outlining the steps for remediation and have worked with hosting providers to issue automated patch alerts. The community is also developing a monitoring service that flags sites running vulnerable versions of Bricksforge. Meanwhile, researchers are analysing the exploit code to understand its full capabilities and to develop detection signatures for intrusion detection systems.

The broader WordPress ecosystem has taken note of the incident. Plugin developers are reviewing their codebases for similar input‑validation issues, and the core WordPress team is accelerating the release of a security patch that addresses related vulnerabilities in the block editor. The incident underscores the importance of regular updates, strict input sanitisation, and proactive security monitoring for all web applications.