October 2026 WordPress Security Roundup: Bricksforge, Core 7.1.4 and a Backdoor That Rebuilds Itself

October 29, 2026 · 4 min read

October 2026 was the busiest month for WordPress security we can remember. While everyone was patching PHP2Shell, three WordPress-specific stories landed that deserve their own attention: a builder add-on exploited in the wild, a core release fixing 22 bugs, and a piece of malware that puts itself back after you delete it. Here is each one in plain language, with the two-minute check that tells you whether it applies to your site.

1. Bricksforge: exploited since 7 October

Bricksforge is a paid add-on for the Bricks visual builder, installed on roughly 6,000 sites. CVE-2026-85097 (CVSS 9.8) lets anyone upload a file without logging in, and attackers used it to drop PHP web shells named like login_admin_*.php into the uploads folder. Patchstack saw the first attempts on 7 October: one cluster of 44 IP addresses sending identical payloads within seconds, another patiently trying 25 file-extension tricks against the same temporary file. Automated, distributed, and ongoing.

Fixed in 3.1.8.10. If you use Bricks, update Bricksforge now, then search wp-content/uploads for any .php file. None of our client sites run Bricks (we build on Elementor and the block editor), so this one did not touch our maintenance queue, but we have been asked about it by two prospective clients whose previous agencies did.

2. WordPress 7.1.4: 22 fixes, one of them serious

On 28 October WordPress 7.1.4 shipped with fixes for 22 security issues. The headline is a race condition in the core update process, reported by Umut Bayram: during an update WordPress unpacks files into wp-content/upgrade/ with predictable folder names, and a cleanup step removed the protective index.php, briefly leaving a full installer reachable from the web. No account is needed, but the window is a few seconds, which is why Patchstack rates real-world exploitation as difficult. Wordfence scores it 8.1 and says it goes back to WordPress 4.7. The remaining fixes are mostly stored XSS in blocks and the Interactivity API, a stored denial-of-service, and a notes-permission bug.

Whether it is already being exploited depends on who you read. GBHackers says yes; WordPress itself has not said so. Either way the fix is free: Dashboard → Updates → Update to 7.1.4. Fixes were backported as far as 4.7.39, so even an old branch can be patched, though if you are on anything older than 6.9 you should be planning a proper upgrade. All MymenTech maintenance clients were on 7.1.4 by the evening of 28 October.

3. The backdoor that heals itself

Sucuri’s Gabriel Barbosa documented a strain of malware, nicknamed SC, that keeps at least eight copies of itself: a .user.ini that prepends a loader to every request, loaders in wp-content, a fake advanced-cache.php, a theme called khorshidi, a must-use plugin and a normal plugin both called hyper-engine-kit, a compressed payload in db.php, and, the clever part, a System V shared-memory segment that survives both file deletion and a database clean. Delete one copy and a cron job with a randomised name rebuilds it from another. It hides from the Plugins screen, takes commands from the Ethereum blockchain, creates a hidden administrator and can inject card-skimming JavaScript.

The lesson is not “install another scanner”. It is that a cleaned site is only clean if every layer was cleaned together: files, database, cron entries, shared memory and PHP configuration files, in one pass, followed by a password and salt rotation. That is why our incident response starts from a fresh WordPress core and known-good plugin copies rather than trying to tidy the infected ones.

4. Also this month

• wpForo Forum (CVE-2026-1581): unauthenticated SQL injection in versions up to 2.4.14, under low-volume exploitation. Update if you run a forum.
• Formidable Forms (CVE-2026-89435, CVSS 8.8) and Gravity Forms (CVE-2026-90437, CVSS 7.2): both disclosed on 30 October, neither confirmed exploited yet. Updates are available; apply them this week.

Your five-minute check

1. Dashboard → Updates. Core should say 7.1.4. Update every plugin with a red badge, and read the changelog of any form, builder or e-commerce plugin.
2. Users → Administrator. Every account should be a real person you know. Delete the rest and change the passwords of the ones you keep.
3. Plugins. Look for anything you did not install, especially names like hyper-engine-kit. Check wp-content/mu-plugins too; it does not appear in the normal list.
4. Uploads. Any .php file inside wp-content/uploads is a problem, full stop.
5. Backups. Confirm the last one exists and is the size you expect. A clean backup turns a bad week into a bad afternoon.

If you are on a MymenTech maintenance plan, all five are done and logged for you every week, and this month they were done daily. If you are not, and any step above worried you, tell us what you found. We will look and tell you honestly whether it needs work.

Sources: SecurityWeek on Bricksforge; WordPress 7.1.4 release notes; Patchstack analysis; The Hacker News on the SC backdoor.