Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity flaw in the Bricksforge plugin for WordPress is under active exploitation, The Hacker News reports. CVE-2026-85097 (CVSS 10.0) lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites; versions up to 3.1.8.9 are affected and a patch is available in version 3.1.8.10.