Is your WordPress site affected by the Bricksforge flaw? What to do today

A serious flaw in Bricksforge, an add-on (called a plugin) for WordPress websites, is being used in real attacks. It can let a stranger take over your site, with no password needed. Security firms report attacks since 7 October 2026.

Are you affected?

Only if your site uses the Bricksforge add-on (WordPress also calls these "plugins"). If your site is on Wix, Squarespace or Shopify, this is not about you.
If your Bricksforge version is older than 4.0.1, update to 4.0.1 (the version the maker recommends). Not sure? Ask your web person.
Ask whoever built or looks after your site (a freelancer, a relative or an agency). Or log in to your site, click Plugins on the left, and look for "Bricksforge".

What to do today

Update Bricksforge to 4.0.1 or newer.
Have the site checked. Updating does not remove a file an attacker already planted, so ask for a check for unknown files that should not be there.
Ask for a short note, with the date, saying the update and the check are done.
If anything looks wrong, change the passwords of everyone who can log in to the site.

A free first look while you wait

Our free check gives your site a score out of 100 and shows the areas that need work, in about a minute. It looks at what your site shows to the world. It cannot tell you if you have this flaw, so do the steps above first. It does not change anything on your site: sitecomb.com/score

Want someone to keep your add-ons up to date?

Our agency partner Sahbis looks after that. Read what "kept up to date" means and what to ask for on Sahbis: who keeps your WordPress add-ons up to date.

Sources (read 28 October 2026): Patchstack, "Critical unauthenticated arbitrary file upload vulnerability exploited in Bricksforge plugin"; SOCRadar on the Bricksforge attacks; BugShield on the Bricksforge vulnerability.