A critical security flaw affecting the Bricksforge plugin for WordPress is reportedly under active exploitation, according to Patchstack. The vulnerability, tracked as CVE-2026-85097, has been assigned a CVSS score of 10.0 and could allow unauthenticated attackers to upload and execute arbitrary PHP code on affected websites.

For European businesses using WordPress for corporate websites, lead generation, content publishing or e-commerce, this is a high-priority security issue because successful exploitation could give attackers direct control over the site environment.

What happened

Patchstack said attackers are actively exploiting a flaw in the Bricksforge WordPress plugin. The reported issue allows remote code execution, meaning an attacker does not need a valid login to run malicious code on a vulnerable server.

In practical terms, unauthenticated remote code execution is one of the most serious classes of web vulnerability. It can potentially let attackers:

• take over a website or web server process
• upload backdoors for persistent access
• redirect visitors to malicious pages
• steal data stored in the website environment
• use the compromised site for phishing, spam or malware delivery

The source report states that exploitation is already taking place in the wild. That increases the urgency for businesses that may be affected.

Why it matters for European businesses

Many SMEs across Europe rely on WordPress as a core digital platform for marketing, customer acquisition, online sales and support. A severe plugin vulnerability can therefore become more than a technical problem: it can interrupt operations, damage trust and create compliance concerns.

If a vulnerable site is compromised, the business impact may include website downtime, defacement, malicious SEO spam, data exposure, loss of leads, and incident response costs. For e-commerce businesses, a breach may also affect checkout flows, customer accounts or integrations with third-party tools.

Where personal data is processed through the affected website, companies may also need to assess whether any incident creates obligations under GDPR, depending on the nature and scope of the compromise.

Who may be affected

The issue is most relevant to organisations that run WordPress websites with the Bricksforge plugin installed. This may include:

• SMEs using WordPress for their main company website
• e-commerce businesses running stores on WordPress-based setups
• marketing teams managing landing pages and campaign sites
• digital agencies maintaining client WordPress environments
• IT teams responsible for website hosting, plugins and server security

Businesses with multiple WordPress properties or less formal patching processes may face greater exposure, especially if plugin inventories are incomplete or website maintenance is outsourced without clear update responsibilities.

What companies should consider

Companies using WordPress should first confirm whether Bricksforge is installed anywhere in their environment, including older campaign sites, microsites and staging systems. If it is present, teams should review the vendor and security guidance immediately and apply any available fixes or mitigations.

• Identify exposure: audit WordPress sites to determine whether the Bricksforge plugin is installed and active.
• Patch quickly: apply the latest security update or vendor-recommended mitigation as soon as it is available and validated.
• Check for compromise: review admin users, file changes, scheduled tasks, plugins, web server logs and unusual outbound activity for signs of exploitation.
• Restrict risk: disable or isolate affected components if patching cannot be completed immediately.
• Harden WordPress operations: reduce unnecessary plugins, enforce least-privilege access, use backups, and ensure monitoring is in place.
• Prepare incident response: if compromise is suspected, involve hosting, security or forensic support quickly and assess any data protection implications.

Because the reported vulnerability is already being exploited, businesses should treat this as an urgent website security review rather than a routine plugin update.