Wordpress Plugin
Security incidents tagged Wordpress Plugin. Newest first.
1 Wordpress Plugin incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 12
- Longest quiet run: 12 days (Oct 13–Oct 24)
- Patched
Bricksforge WordPress plugin: unauthenticated file upload to RCE exploited in the wild (CVE-2026-85097)
CVE-2026-85097 (CVSS 10.0) in the Bricksforge plugin for the Bricks builder lets unauthenticated attackers run PHP on a WordPress site. Bricksforge checks an upload's MIME type but trusts the url field in temporaryFileUploads at form submission, so attackers fetch a nonce, upload a GIF/PHP polyglot and have it written to a .php path. Patchstack saw exploitation from Oct 7 from 63 IPs. Versions through 3.1.8.9 are affected; update to 3.1.8.10 or later.
Bricksforge (WordPress plugin)Since Oct 7, 2026
