CVE-2026-85097: Critical Bricksforge WordPress flaw exploited since October 7

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

Critical Bricksforge WordPress flaw exploited since October 7

Flaw CVE-2026-85097 lets an unauthenticated attacker take over a WordPress site running Bricksforge. Patchstack has observed automated attacks. Users should update to version 3.1.8.10.

Oct 13, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)