Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A critical vulnerability (CVE-2026-85097, CVSS 10.0) in the Bricksforge WordPress plugin is being actively exploited in the wild, allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable websites. The vulnerability stems from insufficient validation of a URL field in the 'temporaryFileUploads' parameter during form submission. Threat actors are leveraging this flaw through a series of steps, including uploading a GIF/PHP polyglot file and submitting a form with a crafted URL. This follows a trend of increased WordPress vulnerability exploitation, with 2,073 vulnerabilities published in Q2 2026, and 573,000 sites compromised. Additionally, threat actors are exploiting XSS vulnerabilities in WPC Product Bundles for WooCommerce and Ninja Forms to deploy a backdoor plugin and create rogue admin accounts.