CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE

Patchstack reported active exploitation of CVE-2026-85097, a critical (CVSS 10.0) unauthenticated arbitrary file upload vulnerability in the Bricksforge WordPress plugin that allows attackers to upload and execute PHP via a GIF/PHP polyglot and a crafted form submission. Exploitation was first observed on 2026-10-07, affected Bricksforge ≤ 3.1.8.9 (fixed in 3.1.8.10, current release 4.0.1), and involved distributed, automated activity from 63 unique IPs; the advisory includes detection indicators, payload/extension variations, and mitigation guidance (update immediately, hunt for planted PHP files, or apply WAF rules).