Bricksforge WordPress Plugin Actively Exploited: Reviewing Your Web Estate Security

SecurityWeek reports that a vulnerability in the Bricksforge WordPress plugin, tracked as CVE-2026-85097, is being actively exploited by threat actors in the wild. The flaw can allow an attacker to take full administrative control of an affected WordPress website. Bricksforge is an extension for the Bricks Builder page builder, which is widely used by web developers and digital agencies to build and manage WordPress sites for clients across a broad range of sectors. The vulnerability was reported on 12 October 2026, with active exploitation already confirmed at the time of publication.

Why this matters for UK organisations

WordPress powers a substantial proportion of websites used by UK businesses — from marketing and e-commerce sites to client portals and internal tools. The plugin ecosystem is one of WordPress's greatest strengths, but it is also one of its most persistent security challenges. Plugins are developed by a wide range of third parties, patch cycles vary considerably, and many organisations — particularly those whose sites are managed by external agencies — do not have a reliable process for monitoring vulnerability disclosures and ensuring timely updates. When a plugin vulnerability reaches active exploitation, the consequences of a compromised site can be significant: malicious redirects, credential harvesting forms, hosted malware, defacement, or the site being used as infrastructure for further attacks. Each of these outcomes carries reputational, regulatory and operational risk for the organisation whose brand is associated with the site, regardless of whether the site is managed in-house or externally.

What to review

Organisations should check whether Bricksforge is installed on any WordPress sites they own or are responsible for, and confirm that it has been updated to a version that addresses CVE-2026-85097. Where sites are managed by a third-party agency or developer, contact them directly to request confirmation that the plugin has been reviewed and patched. This incident is also a broader prompt to review whether your web estate — including sites managed externally — has a clearly defined and owned process for plugin vulnerability monitoring, update management and periodic security review. Ensuring that responsibility for website security is explicitly assigned, rather than assumed to sit with a third party, is an important governance step that many organisations have yet to formalise.

Source: SecurityWeek