Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A critical vulnerability CVE-2026-85097 with a maximum CVSS score of 10.0 has been discovered in the Bricksforge plugin for WordPress. The flaw allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The vulnerability is actively being exploited in the wild, as reported by Patchstack. The severity of this flaw is maximum, making it an urgent priority for WordPress site administrators using the Bricksforge plugin to patch immediately. No authentication is required to exploit this vulnerability, significantly widening the attack surface.