CVSS 10.0 Bricksforge WordPress Flaw Actively Exploited for Unauthenticated RCE

A maximum-severity vulnerability in the Bricksforge plugin for WordPress is under active exploitation, according to Patchstack. CVE-2026-85097 (CVSS 10.0) lets unauthenticated attackers upload and execute arbitrary PHP code, enabling remote code execution.

• CVE-2026-85097 carries a maximum CVSS score of 10.0
• Unauthenticated RCE via arbitrary PHP code upload
• Patchstack confirmed active exploitation in the wild