The active exploitation of CVE-2026-85097 in the Bricksforge WordPress plugin highlights a fundamental weakness in web application security: validating an uploaded file is not sufficient if the application subsequently trusts information supplied by the user without independently verifying it.

The critical vulnerability, carrying the maximum CVSS score of 10.0, allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites. What makes this particularly concerning is the exploitation technique. Attackers upload a specially crafted file that passes the initial image validation, then manipulate the file metadata during form submission to cause the application to save it as executable PHP code.

The result is a serious breakdown in application security controls. A feature designed to handle legitimate user uploads can become an entry point for remote code execution, potentially allowing attackers to deploy webshells, access sensitive information, modify website content and establish persistent access.

Researchers have already observed active exploitation involving 63 unique source IP addresses, including coordinated requests and multiple variations of PHP file extensions and encoding techniques. These patterns indicate that attackers are automating exploitation and experimenting with different methods to bypass security restrictions.

The incident reinforces why cybersecurity cannot depend exclusively on file extensions, MIME-type validation or individual application security checks. Secure application development must enforce server-side validation, strict file-handling policies and separation between uploaded content and executable code.

For organizations operating public-facing websites, timely patching must be complemented by Web Application and API Protection (WAAP), malicious upload detection, behavioral monitoring, intrusion prevention and continuous vulnerability assessment. Security controls should also identify suspicious request patterns, abnormal file operations and unexpected executable content within upload directories.

The broader lesson is that a file can be technically valid and still be malicious. Effective cybersecurity must evaluate not only whether an input meets its expected format, but also how that input is subsequently processed, stored and executed.

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

Source: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE via The Hacker News — published 12 Oct 2026.