Bricksforge WordPress Plugin Flaw Puts Websites at Risk

A critical vulnerability in the Bricksforge plugin for WordPress is being actively exploited. Tracked as CVE-2026-85097, the flaw has received a maximum CVSS score of 10.0 and affects Bricksforge versions up to 3.1.8.9. It is especially relevant for Indian SMEs, clinics, schools, startups and agencies that rely on WordPress websites but may not regularly review plugin updates.

The weakness can allow an attacker to upload a file that appears to be an image but contains harmful PHP code. Once placed on a vulnerable website, the file may let the attacker run code on the server. This could lead to website defacement, scam pages, stolen data, malware being served to visitors or a hidden backdoor that gives attackers future access.

Website owners should check immediately whether Bricksforge is installed and update it to the latest version provided by the developer. Updating is important, but it may not remove an infection if the site was already compromised. Review unfamiliar administrator accounts, plugins and PHP files, particularly in the plugin’s temporary upload folders. Web agencies and freelancers should also confirm who is responsible for regular updates, monitoring and backups after a website goes live.

This incident is a reminder that every WordPress plugin increases the need for ongoing maintenance. Remove unused plugins, use strong and unique administrator passwords, enable two-factor authentication and maintain recent off-site backups. Prompt updates and regular checks can help businesses keep their websites reliable for customers.

Patching the vulnerable plugin is the essential fix for this issue. For businesses that manage websites on Windows servers, Net Protector Z Security for Server provides protection against malicious network activity as an additional security layer. It should complement—not replace—timely WordPress updates, backups and secure website administration.