---
title: Bricksforge WordPress plugin CVE-2026-85097 unauthenticated RCE | ctxsec
url: https://ctxsec.com/items/bricksforge
description: ""
status: "exploited (Patchstack), not independently re-verified"
published: 2026-10-12
---

> 

[← Cybersecurity News](/news) · [markdown](/items/bricksforge.md)

exploited (Patchstack), not independently re-verified

2026-10-12

### Bricksforge WordPress plugin CVE-2026-85097 unauthenticated RCE

Patchstack reports first exploitation on Oct 7. Update the plugin or remove it. We could not reach a primary advisory page today, so treat details as preliminary. Not in KEV as of Oct 13.

Sources: [Patchstack database](https://patchstack.com/database/) · [@averyjparker summary](https://x.com/averyjparker/status/2109617279910674795)