CVE-2026-85097Vulnerability
Reported by 3 independent sources · first reported by The Hacker News · last reported
Last reported 12 days ago
higher than 70% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE“CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“…01, CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 (Cisco), CVE-2026-76281, CVE-2026-76282, CVE-2026-76284, CVE-2026-76268 (Splunk), CVE-2026-85097 (Bricksforge WordPress plugin), CVE-2026-93836 (WPC Product Bundles for WooCommerce WordPress plugin), CVE-2026-94504 (Ninja Forms W…”
-
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild“The vulnerability is tracked as CVE-2026-85097 and it has a CVSS score of 9.8.”
-
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE“The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE).”
Indicators reported together
named in the same reports- 3.1.8[.]9in 2 reports
- 177.75.57[.]20in 2 reports
- 23.97.62[.]146in 2 reports
- 84.247.60[.]125in 2 reports
- 38.154.185[.]97in 2 reports
- 150.109.16[.]166in 2 reports
- 153.75.90[.]146in 2 reports
- fbijobs[.]govin 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2026-93836, CVE-2026-94504, CVE-2026-102489, CVE-2026-102490, CVE-2026-96940, CVE-2026-59265, CVE-2026-63277, CVE-2026-21589, CVE-2026-86360, CVE-2026-86361, CVE-2026-86362, CVE-2026-91140
Thanks — we review every report.