A severe Bricksforge bug allows attackers to run code on vulnerable WordPress sites; patch now, and scan for suspicious uploads
Security researchers warn about a critical Bricksforge flaw for WordPress that can let attackers run code on vulnerable sites without logging in. Patches are available in a newer Bricksforge release, and exploitation was observed starting Oct 7, 2026. If you run WordPress, update Bricksforge now and check upload-related endpoints for unusual activity.
What this means for you: apply the patch, verify your site isn’t accepting risky uploads, and coordinate with your developer if you’re unsure about patch status. What happens next: update the plugin and monitor for any suspicious file activity in upload folders.
Read in: English Français Deutsch Español
A severe vulnerability in the Bricksforge plugin for WordPress is being actively abused. The flaw can let an attacker execute code on the target server without logging in, giving them control over the site. Security researchers flagged active exploitation on October 7, 2026, and a fix was released in a newer Bricksforge update after that discovery.
Bricksforge is marketed as a multipurpose toolkit for Bricks, the visual page builder for WordPress. The issue stems from how the plugin validates input tied to file uploads during form submissions. Attackers can craft requests that point to a PHP payload and bypass certain checks, causing the server to run the attacker’s code when the implicated file is accessed.
The problem comes from a split in how the plugin handles uploaded files. While the plugin checks the MIME type during upload, an attacker can submit metadata that refers to a PHP file while the actual uploaded content looks like an image. By manipulating the path and the file extension, the server can end up executing the embedded PHP code. This sequence enables remote control of the site in a few carefully crafted steps.
Any WordPress site using Bricksforge versions up to the previously affected release is at risk. Researchers observed probing activity across multiple sources as attackers searched for a working path to trigger code execution. A fix has been provided in a newer Bricksforge release to close the vulnerability.
Update Bricksforge to the version that contains the fix as soon as possible. After updating, review the plugin’s form submission endpoints and watch for unusual activity in the temporary upload directories to catch any lingering attempts.
If you manage a WordPress site, you should apply the Bricksforge patch now. If you rely on developers or agencies, confirm they’ve updated the plugin and reviewed upload handling. A single vulnerable component can let an attacker take over a site or exfiltrate data.
Install the fixed Bricksforge release and monitor for unusual upload activity. If you’re unsure whether your site is patched, contact your hosting provider or developer to verify the plugin version and confirmation of the update.
A vulnerability in Bricksforge for WordPress that can enable remote code execution via the temporary uploads flow when form submissions are processed.
Yes. Update Bricksforge to the patched release to mitigate active exploitation risks.
Yes. The advisory notes additional plugin issues that could enable persistence or backdoors, so keep all plugins up to date and audit upload-related functionality.
You're reading the quick version.
A growing number of parents say they’re limiting their children’s access to social media and AI tools, citing safety, privacy and well-being concerns.
An expert argues that the simple rules of TCP/IP keep networks reliable as AI and automation push critical systems to new limits.
Japan orders tighter security after a surge of attacks leaks data from millions of customers, with new powers to neutralize threats coming into force.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
