WordPress plugins Bricksforge and All in One SEO face security vulnerabilities

Multiple security vulnerabilities have been identified in popular WordPress plugins, including a critical flaw in Bricksforge and exploits in the All in One SEO (AIOSEO) plugin.

Bricksforge is facing active exploitation of a critical vulnerability (CVE-2026-85097) with a CVSS score of 10.0. The flaw allows unauthenticated attackers to upload malicious files and execute arbitrary PHP code by exploiting inconsistent validation during file uploads. This can lead to web shells, data theft, and persistent unauthorized access. Administrators are urged to upgrade to version 3.1.8.10 or later.

Separately, the All in One SEO plugin, used by over two million installations, is vulnerable to two exploits. One vulnerability (CVE-2026-100152), rated 6.5, allows unauthenticated attackers to execute arbitrary WordPress shortcodes if AIOSEO breadcrumbs are rendered on search results pages. This occurs due to a missing validation check before the plugin processes the `do_shortcode` function.