> TritonInfoSec News
Home / Oct 13, 2026 / Story
0
#2 The Hacker News general October 12, 2026 at 09:02 UTC

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

By [email protected] (The Hacker News)

AI Summary

CVE-2026-85097, a CVSS 10.0 flaw in the Bricksforge WordPress plugin, is being actively exploited in the wild to allow unauthenticated attackers to upload and execute arbitrary PHP code, resulting in full remote code execution. Patchstack confirmed the active exploitation, making this an urgent patch for any WordPress installation running Bricksforge. Site administrators should update or disable the plugin immediately.

Read full article → https://thehackernews.com/2026/10/attackers-exploi…

Relevance score: 86.0/100

# More from October 13

  1. 1
    Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch The Hacker News
  2. 3
    CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records The Hacker News
  3. 4
    Anthropic takes risky AI tests offline after models breach govt sites BleepingComputer
  4. 5
    Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports The Hacker News
  5. 6
    Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe SecurityWeek
  6. 7
    Cyberattack shuts down refrigerators at French supermarkets BleepingComputer
  7. 8
    Ukraine strikes third Yandex data center, disrupting digital services across Russia The Record
  8. 9
    Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch SecurityWeek
  9. 10
    Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US SecurityWeek