A maximum-severity vulnerability in the Bricksforge plugin for WordPress is being exploited in the wild, according to security firm Patchstack, which disclosed the activity in a report covered by The Hacker News on 7 October 2026.
The flaw, tracked as CVE-2026-85097 and scored at CVSS 10.0 — the highest possible rating — lets an unauthenticated visitor upload and then execute arbitrary PHP code on any site running a vulnerable version of the plugin. In practice, that means no login, no valid account and no interaction beyond a crafted request is needed to achieve remote code execution (RCE) on the affected server.
Who is exposed
Bricksforge is a companion plugin for the Bricks visual page builder, so the blast radius extends well beyond hobby blogs. Anyone running the plugin on a production site is a candidate target, including:
- Web agencies and freelancers that ship Bricks-based client sites, often managing dozens or hundreds of WordPress installs from a single workflow;
- Businesses and content publishers whose marketing sites, catalogues or member portals are built on the Bricks ecosystem;
- Managed-hosting and maintenance-plan providers that patch customer sites on a schedule rather than in real time.
For these operators, the realistic worst case is complete site takeover: an attacker can plant a webshell, rewrite pages, distribute malware or phishing kits to visitors, use the hosting account as a pivot point into other tenancies on the same server, and establish persistence that survives casual cleanup.
The incident also fits a broader pattern. Page-builder companion plugins routinely receive deep, privileged hooks into WordPress in order to automate design and deployment tasks — and that convenience frequently comes with loosely guarded file-handling endpoints. Security researchers have repeatedly warned that this category of plugin is now among the most attractive targets for supply-chain-style mass exploitation, because compromising one widely deployed builder add-on can yield thousands of reachable sites.
Mitigation, including when you cannot patch immediately
The primary remediation is straightforward: update Bricksforge to the version in which the vendor fixed the flaw. Administrators should check the official WordPress plugin repository or their dashboard for the current release rather than relying on any third-party summary, then confirm the installed version on every site under their management. Sites that cannot be updated on short notice — for example, on shared hosting plans with limited change windows — have limited options, but damage can be reduced by deploying WAF or edge rules that block unauthenticated requests to the plugin's upload endpoints, denying PHP execution in uploaded-file directories, disabling unnecessary plugin modules, and tightening file permissions so the web user cannot write where it does not need to. Logging and file-integrity monitoring around wp-content/plugins and upload directories should be treated as mandatory while the flaw remains unpatched.
For Hong Kong organisations that rely on WordPress — particularly those on managed-hosting or maintenance-plan arrangements where plugin updates are applied on a delay — this story is a useful reminder that a CVSS 10.0 flaw with confirmed in-the-wild exploitation leaves very little margin for a monthly patch cycle. Any site still running an unpatched version of Bricksforge should be treated as potentially compromised until verified otherwise.
安全公司 Patchstack 披露，WordPress 外掛 Bricksforge 的最高嚴重程度漏洞已在野外遭實際利用，相關活動已於 2026 年 10 月 7 日經 The Hacker News 報導。
該漏洞編號為 CVE-2026-85097，評分達 CVSS 10.0——即最高等級——未經認證的訪客即可上載並於任何安裝了有漏洞版本外掛的網站上執行任意 PHP 代碼。實際而言，攻擊者毋須登入、毋須有效帳戶，亦毋須與系統有任何互動，只需一個精心構造的請求，便可在受影響的伺服器上達成遠端執行代碼（RCE）。
誰人受影響
Bricksforge 是 Bricks 視覺化頁面建構器的配套外掛，因此影響範圍遠超個人興趣網誌。任何在正式網站上運行此外掛的人士均為潛在目標，包括：
- 網頁設計公司及自由工作者：為客戶交付基於 Bricks 的網站，往往透過單一流程管理數十以至數百個 WordPress 安裝；
- 企業及內容發佈商：其市場推廣網站、產品目錄或會員門戶均建基於 Bricks 生態系統；
- 代管託管及保養計劃服務商：按既定時間表而非即時為客戶網站進行修補。
對這些營運者而言，最現實的最壞情況是網站被完全控制：攻擊者可植入 webshell、改寫網頁、向訪客散發惡意軟件或釣魚工具包、以託管帳戶作為跳板入侵同一伺服器上的其他租戶，並建立可逃過一般清理的持久化機制。
今次事件亦符合一個更廣泛的模式。頁面建構器的配套外掛通常會取得深入且具權限的 WordPress hook，以自動化設計及部署工作——而這份便利往往伴隨防護鬆散的檔案處理端點。安全研究人員已多次警告，此類外掛現已成為供應鏈式大規模攻擊的最吸引目標之一，因為攻破一個廣泛部署的建構器附加元件，即可令數以千計的網站暴露於風險之中。
緩解措施，包括未能即時修補時的應對
主要補救方法相當直接：將 Bricksforge 更新至供應商已修復漏洞的版本。管理員應到官方 WordPress 外掛倉庫或後台控制台查看最新版本，而非依賴任何第三方摘要，然後逐一確認其管理下每個網站的已安裝版本。無法短期內更新的網站——例如採用變更時段有限的共享託管計劃——選擇有限，但仍可透過以下方法減少損失：部署 WAF 或邊緣規則，封鎖向外掛上載端點發出的未經認證請求；在上載檔案目錄內禁止執行 PHP；停用不必要的外掛模組；以及收緊檔案權限，確保網站用戶無法寫入不需要寫入的位置。在外掛漏洞尚未修補期間，wp-content/plugins 及上載目錄的日誌記錄及檔案完整性監控應視為必須措施。
對於依賴 WordPress 的香港機構而言——尤其是在代管託管或保養計劃安排下、外掛更新須延後才套用的機構——今次事件是一個有用的提醒：一個已確認在野外遭利用的 CVSS 10.0 漏洞，實在難以容納每月一次的補丁週期。任何仍在運行未修補版本 Bricksforge 的網站，在經核實之前，均應被視為可能已遭入侵。