CRITICALVulnerability
Global

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

·Source: The Hacker News

Updated:

Executive Summary

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

Analysis

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

Indicators of Compromise (1)

CVE (1)
CVE-2026-85097
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Oct 12, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Breach Roundup: Russian Hackers Hit Ukrainian Grain Firm

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/breach-roundup-image_small-2-a-33182.jpg" align=right hspace=4><b>Also: eMudhra Exits TLS Cert Biz, German Police Probe 2024 Synnovis Cyberattack</b><br>Russian hackers wiped a Ukrainian grain logistics firm, eMudhra killed its TLS certs biz, Germany investigated the 2024 Synnovis hack, OpenCode flaw, another Nikkei breach. A Revo

Bank Info Security
MEDIUMVulnerability

Indian tech company eMudhra announces withdrawal from certificate business after security incident

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

The Record
MEDIUMVulnerability

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its

The Hacker News