Maximum-Severity Vulnerabilities Under Active Exploitation
This week brings a stark reminder that patch windows have effectively vanished. Two critical vulnerabilities—one achieving the rare perfect 10.0 CVSS score—are being actively exploited just days after public disclosure, leaving organizations scrambling to defend infrastructure already under attack.
Bricksforge WordPress Plugin: CVSS 10.0 Unauthenticated RCE
A maximum-severity flaw in the Bricksforge WordPress plugin is now under active exploitation, according to Patchstack. The vulnerability enables unauthenticated remote code execution—the worst-case scenario for any web application.
Bricksforge is a popular extension for the Bricks page builder, installed on thousands of WordPress sites. The flaw allows attackers to execute arbitrary code without any authentication, effectively handing over complete control of vulnerable websites.
Immediate action required:
- Audit all WordPress installations for the Bricksforge plugin
- Update to the patched version immediately if installed
- Review web server logs for suspicious requests targeting
/wp-content/plugins/bricksforge/ - Consider temporarily disabling the plugin until patches are verified
- Implement web application firewall rules to block exploitation attempts
WordPress plugin vulnerabilities remain one of the most common attack vectors for web compromise. The combination of widespread installation, delayed patching, and the ability to achieve RCE makes these flaws particularly dangerous.
SonicWall SSRF Flaw Exploited Within Days
A critical pre-authenticated server-side request forgery (SSRF) vulnerability in SonicWall devices (CVE-2026-102255) is being actively exploited just days after disclosure. The flaw allows attackers to perform unauthorized operations without authentication.
SonicWall appliances are deployed as network perimeter devices in thousands of organizations. An SSRF vulnerability in this position is particularly dangerous—it can be leveraged to:
- Bypass authentication mechanisms
- Access internal network resources
- Pivot to additional systems
- Establish persistent access through firewall modifications
Recommended response:
- Identify all SonicWall devices in your environment immediately
- Apply vendor patches as priority-zero emergency maintenance
- Review firewall logs for unusual configuration changes or access patterns
- Implement network segmentation to limit potential lateral movement
- Consider placing SonicWall management interfaces behind additional access controls
The speed of exploitation—mere days after disclosure—underscores a troubling trend. Attackers are increasingly prepared with exploitation frameworks ready to deploy the moment vulnerability details become public.
AI-Augmented Campaigns Target WordPress and E-Commerce
Cybersecurity researchers have documented a two-pronged AI-augmented campaign by the CyberXero group that successfully stole over 628,000 Ukrainian records. The campaign targeted WordPress sites, e-commerce platforms, and critical infrastructure using Claude Code to enhance their initial access techniques.
This represents a practical demonstration of AI tools being weaponized for offensive operations. The use of AI coding assistants allows attackers to:
- Rapidly develop custom exploits for newly disclosed vulnerabilities
- Generate polymorphic malware that evades signature-based detection
- Automate reconnaissance and target identification
- Scale attack operations with less technical expertise required
The CyberXero campaign specifically focused on WordPress and e-commerce platforms, suggesting attackers are targeting high-value data repositories where customer information, payment details, and credentials are stored.
Defense priorities:
- Implement behavior-based detection that identifies malicious activity patterns rather than signatures
- Increase logging and monitoring for WordPress admin actions and database queries
- Deploy rate limiting and anomaly detection on authentication endpoints
- Conduct regular security assessments of web applications and e-commerce platforms
Supply Chain Security: CISA Adds Legacy Vulnerabilities to KEV
CISA's Known Exploited Vulnerabilities catalog received several additions this week, including notably old flaws in ISC BIND (CVE-2015-5477), Apache Struts (CVE-2016-3081), and ProFTPD (CVE-2015-3306). The inclusion of vulnerabilities from 2015 and 2016 signals that attackers continue to successfully exploit legacy systems that have gone unpatched for years.
This pattern appears repeatedly: organizations focus on the latest threats while neglecting decade-old systems that remain exposed to the internet. These legacy vulnerabilities provide reliable, well-documented attack paths that require minimal sophistication to exploit.
Legacy system mitigation:
- Inventory all internet-facing systems, including those considered "legacy" or "maintenance-only"
- Prioritize patching or isolation of systems with CISA KEV-listed vulnerabilities
- Implement network segmentation to limit exposure of systems that cannot be patched
- Consider decommissioning systems that can no longer receive security updates
Certificate Validity Reduction: Automation Becomes Mandatory
Let's Encrypt announced it will reduce default certificate validity to 64 days beginning February 2027, with a further reduction to 45 days planned. This continues the industry trend toward shorter certificate lifespans to reduce the window of exposure if private keys are compromised.
For organizations still managing certificates manually, this change makes automation non-negotiable. Manual certificate renewal on a 45-day cycle is operationally unsustainable and will inevitably result in expired certificates causing outages.
Certificate management modernization:
- Implement ACME protocol automation for certificate renewal
- Audit all TLS certificates across your infrastructure, including internal services
- Establish monitoring and alerting for certificate expiration
- Document certificate renewal procedures and test automation before the February deadline
Takeaway: The Patch Window Has Closed
This week's exploitation activity demonstrates that organizations can no longer rely on a comfortable window between disclosure and exploitation. Critical vulnerabilities in WordPress plugins, network appliances, and web applications are being exploited within days—sometimes hours—of public disclosure.
The combination of AI-assisted exploit development, pre-positioned attack infrastructure, and the continued success of legacy exploits demands a defensive posture built on:
- Automated patch management with emergency procedures for critical flaws
- Defense-in-depth architecture that assumes perimeter compromise
- Continuous monitoring and behavior-based detection
- Regular security assessments that identify vulnerabilities before attackers do
If your organization needs help assessing exposure to these vulnerabilities or implementing the defensive measures outlined above, Vici Tech Solutions offers penetration testing and security assessments designed to identify and remediate critical risks before they're exploited.