--- title: "All in One SEO and Bricksforge flaws: what to update first" description: "Bricksforge needs 4.0.1 or newer and All in One SEO needs 5.0.2.1 or newer. Update Bricksforge first, then check users, files and redirects for damage." url: "https://webleveling.com/blog/bricksforge-all-in-one-seo-wordpress-flaws/" lang: "en" published: "2026-10-12" modified: "2026-10-13" author: "Cal Hewitt" tags: ["website-security","wordpress","website-maintenance"] image: "https://webleveling.com/og/blog-bricksforge-all-in-one-seo-wordpress-flaws.jpg" alternates: es: "https://webleveling.com/es/blog/vulnerabilidades-de-bricksforge-y-all-in-one-seo.md" --- # All in One SEO and Bricksforge flaws: what to update first Bricksforge needs 4.0.1 or newer and All in One SEO needs 5.0.2.1 or newer. Update Bricksforge first, then check users, files and redirects for damage. ![A small screwdriver set and a closed padlock resting on a folded cloth on a workbench.](https://webleveling.com/blog/bricksforge-all-in-one-seo-wordpress-flaws/bricksforge-aioseo-update-featured.jpg) You read that attackers are going after a Bricks add-on and that a popular SEO plugin has two flaws, and you need to know tonight whether your site is exposed. The short version: open your WordPress Plugins screen, look for Bricksforge and All in One SEO, and write down the version number next to each. Bricksforge comes first, because it carries the more serious flaw. The All in One SEO vulnerability records are less severe, but they are fixed in a version you can install in minutes. Updating closes the hole; it does not tell you whether someone walked through it earlier, so a short damage check belongs right after the update. Nothing here needs a developer if your site is current, backed up and behaving normally. It does need you to look today rather than next week. **Key Takeaways** **Update Bricksforge first** Install Bricksforge 4.0.1 or newer. Its CVE-2026-85097 file-upload flaw is rated 9.8 out of 10 and lets an unauthenticated visitor run code on the server in versions through 3.1.8.9. **Then All in One SEO** Install 5.0.2.1 or newer. It covers both October flaws, which are rated medium and have different prerequisites. **Updating is not the finish line** Check users, the uploads folder, changed files, redirects and Search Console after the update, because a patch does not remove anything already planted. ## What should you update first, and to which version? Start with a ten-minute look at your own site. In WordPress, open Plugins, then Installed Plugins, and search for "Bricksforge" and "All in One SEO." Note whether each one is active, inactive or missing, and write down the version. If a plugin is not there, leave it that way; there is no reason to install either one just to test your site. Check the same screen for pending updates to WordPress itself, your theme and other plugins while you are there. Take a backup before you change anything, using your host's backup tool or a backup plugin you already trust, and follow the steps in WordPress's [guide to managing plugins](https://wordpress.org/documentation/article/managing-plugins/) if you have not updated one by hand before. ![A closed laptop beside a blank notepad and a pencil on a plain wooden desk.](https://webleveling.com/blog/bricksforge-all-in-one-seo-wordpress-flaws/plugin-version-notepad.jpg) Write down the version of each plugin before you touch anything. Here are the affected and fixed versions as of October 12, 2026. Which versions to install | Plugin | The flaw | Affected | Install | | --- | --- | --- | --- | | Bricksforge | CVE-2026-85097, unauthenticated arbitrary file upload (CVSS 9.8, critical) | 3.1.8.9 and earlier | 4.0.1 or newer | | Bricksforge | Pro Forms file upload security issue, fixed October 8, 2026 | Every site with Pro Forms active, per the vendor | 4.0.1 or newer | | All in One SEO | CVE-2026-85492, DOM-based cross-site scripting (CVSS 6.1, medium) | 5.0.1.1 and earlier | 5.0.2 or newer | | All in One SEO | CVE-2026-19856, arbitrary shortcode execution (CVSS 6.5, medium) | Before 5.0.2.1 | 5.0.2.1 or newer | Bricksforge is a paid add-on for the Bricks builder, so if the update does not appear on your Plugins screen, get it from your Bricksforge account. For All in One SEO, 5.0.2.1 or any later release covers both records; the version listed in its [changelog](https://aioseo.com/changelog/) on October 6 was 5.0.3. **Update, October 13, 2026:** Bricksforge released 4.0.2 the day after this post's date. The vendor's [changelog](https://bricksforge.io/version-changelog/) says the upload check added in 4.0.1 refused roughly one normal image in sixty, which 4.0.2 corrects while still rejecting files that carry code, and 4.0.2 also tightens several of the plugin's other endpoints. If you are reading this after that date, install 4.0.2 or newer. The vendor also suggests renewing any API keys stored in Bricksforge's tool settings at the provider as a precaution. ## How serious is the Bricksforge flaw for your site? Serious enough to do first. The [CVE record for CVE-2026-85097](https://nvd.nist.gov/vuln/detail/CVE-2026-85097) was published on October 8, 2026 and describes an unauthenticated arbitrary file upload in versions up to and including 3.1.8.9. "Unauthenticated" means the person does not need a login. According to the record, an attacker can request a valid security token from the site, upload a file that looks like a harmless image but also contains PHP code, and then submit a form in a way that makes the server run that code. Code running on your server can create users, change files or send spam, which is why the record rates it 9.8 out of 10. Some headlines say 10.0. The record itself says 9.8, and that is the figure to use. The number matters less than what it means for you: if your site ran Bricksforge 3.1.8.9 or earlier with the plugin active, treat it as exposed. The vendor's changelog adds a point that catches people out. Version 4.0.1, released October 8, 2026, includes a security fix for the Pro Forms file upload, and the changelog says it affects every site with Pro Forms active, including sites whose forms have no upload field. So, the question is not "do my forms take uploads?" It is "is Pro Forms switched on?" The same entry notes that CVE-2026-85097 was fixed earlier, in 3.1.8.10 and 4.0.0, and 4.0.1 is the release that carries the newest upload fix. Patchstack, a WordPress security company, marks this flaw "Known to be exploited" in its [Bricksforge advisory](https://patchstack.com/database/wordpress/plugin/bricksforge/vulnerability/wordpress-bricksforge-plugin-3-1-8-9-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter-vulnerability), rates it 10 out of 10 and lists 3.1.8.10 as the fixed version. Whether or not your site was targeted, a site that was running an affected version before you updated is worth the damage check below. Bricksforge is an add-on, not part of WordPress itself, and it is separate from the Bricks theme, so a site that uses Bricks without Bricksforge is not covered by these records. ![A folded blank form and a small metal key lying on a wooden shelf.](https://webleveling.com/blog/bricksforge-all-in-one-seo-wordpress-flaws/pro-forms-active-check-form.jpg) The Pro Forms feature, not an upload field, decides whether the vendor's fix applies to you. ## What do the two All in One SEO flaws mean for you? They are real, they are fixed, and they are less urgent than the Bricksforge flaw. Both were published on October 2, 2026, and they differ in what an attacker needs. [CVE-2026-85492](https://nvd.nist.gov/vuln/detail/CVE-2026-85492) is a DOM-based cross-site scripting flaw in versions up to and including 5.0.1.1, rated 6.1. The attacker does not need an account, but the harm only happens when someone who holds the plugin's SEO-management capability, typically an administrator, opens the SEO Preview panel while visiting a page with a booby-trapped address. It was fixed in 5.0.2, released on September 22, 2026. [CVE-2026-19856](https://www.cve.org/CVERecord?id=CVE-2026-19856) is a shortcode execution flaw in versions before 5.0.2.1, rated 6.5. A visitor with no login can cause the site to run shortcodes that other plugins have registered, through a search query. The record adds that on sites upgraded from older versions the protection is switched off outright, so no crafted input is needed. The [WPScan entry](https://wpscan.com/vulnerability/e35365d3-65de-45a7-9629-17aacd5299c7/) carries the same description. The fix landed in 5.0.2.1 on October 1, 2026, which the changelog describes as improved security protections for shortcodes on search pages. ![A small stack of blank index cards held with a metal clip beside a pencil on a desk.](https://webleveling.com/blog/bricksforge-all-in-one-seo-wordpress-flaws/aioseo-fixed-versions-cards.jpg) Two records, two fixed versions. Installing 5.0.2.1 or newer covers both. Medium ratings are not an invitation to wait. The shortcode flaw needs no login, and what it can do depends on which other plugins sit on your site. Install the update with the rest. ## How do you check your site for damage after updating? A patch stops the next attacker. It does not remove a file or account that someone already planted, so the check below is what tells you whether your site is clean. WordPress.org's [guide for a hacked site](https://wordpress.org/documentation/article/faq-my-site-was-hacked/) and its [hardening guide](https://developer.wordpress.org/advanced-administration/security/hardening/) cover the same ground in more depth. Work through these in order, and stop and call for help if you find something you do not recognize: - **Users**: Open Users and look for administrator accounts you did not create, or recent accounts with odd names or addresses. - **Uploads folder**: Look in the uploads directory, through your host's file manager, for files ending in .php. Image folders should not hold any. - **Changed files**: Ask your host for a list of files modified in the last two weeks, or use a scanner such as [Wordfence](https://www.wordfence.com/help/scan/), and look for themes or plugins you did not touch. - **Redirects and pages**: Visit your site on a phone, from a search result, and click through. Look for redirects to strange addresses, pop-ups or pages you never wrote. - **Search Console**: Check for security warnings, spam pages and indexed addresses you do not recognize. - **Credentials**: If anything looks wrong, change your WordPress, hosting, database and FTP passwords, and any API keys the site stores. A security scan is useful, but it can miss changes in the database or on the server, so a clean scan is a good sign and not a guarantee. If you find an unfamiliar admin account or a PHP file in the uploads folder, keep a copy of the logs and a backup, restrict access, and ask your host or a security professional to compare your files and database against a clean copy. Our guide to the [first 24 hours after a hacked website](https://webleveling.com/blog/website-hacked-first-24-hours/) lays out the steps in the order to take them. ![A small padlock resting on a ring of keys next to a blank paper checklist on a desk.](https://webleveling.com/blog/bricksforge-all-in-one-seo-wordpress-flaws/damage-check-keys-padlock.jpg) Updating locks the door. The check tells you whether anyone is already inside. ## How do exposed, exploited and compromised differ? They are three separate questions, and mixing them up is how people either panic or relax too soon. Exposed means your site ran an affected version. Exploited means attackers have used the flaw somewhere. Compromised means someone got into your site specifically. For Bricksforge, you were exposed if you ran 3.1.8.9 or earlier with the plugin active, or any version before 4.0.1 with Pro Forms active. For All in One SEO, you were exposed on 5.0.1.1 or earlier for the first record and on anything before 5.0.2.1 for the second. Exposure alone does not mean you were attacked. A high severity score does not prove that your site was hit either; it measures what an attacker could do. Only your own users, files, logs and Search Console can say whether you were compromised, and that is what the checklist above looks at. If you were exposed, write down which versions you were running and the date you updated. Your host may keep logs for a limited time, so ask for them early if you suspect a problem. ## Can you handle this yourself, or should you call for help? If you can log in to WordPress, you can usually do this one yourself. Check the two versions, update, test your homepage, contact form, login and search, and run the damage check. A current, backed-up site that behaves normally and shows nothing odd does not need a rebuild or a paid cleanup. Paid help makes sense in a few situations: you cannot reach the Bricksforge account, you look after several sites and cannot be sure each was updated, your backups are missing or untested, or the damage check turned up something strange. In those cases, a [website security audit](https://webleveling.com/services/website-security-audit/) compares your files and database against a clean copy, and ongoing [website maintenance](https://webleveling.com/services/website-maintenance/) puts a named person in charge of updates so a notice like this one is handled the day it appears. The general routine for this is in our guides to [checking your WordPress plugins for security updates](https://webleveling.com/blog/check-wordpress-plugins-for-urgent-security-updates/) and to [recurring plugin vulnerability warnings](https://webleveling.com/blog/wordpress-plugin-vulnerability-warning/). When a flaw hits a form plugin, the question is the same: which version, which fix. Our post on the [Ninja Forms vulnerability](https://webleveling.com/blog/ninja-forms-vulnerability-wordpress-contact-form/) walks through that case. ## Would a site with no third-party plugins avoid this? It would avoid this kind of notice. A site built without third-party plugins has no Bricksforge or All in One SEO to patch, and that removes one of the regular chores of owning a WordPress site. [Web Leveling](https://webleveling.com/) builds [custom sites with no third-party plugins](https://webleveling.com/services/web-design/), hand-coded so that forms, SEO tags and everything else are part of the site you own. It does not remove the rest of the work. Every site still needs hosting, backups, access control and someone watching them, and a plugin-free build is not a promise of zero maintenance. WordPress remains a fair choice for a site you keep up to date; this is an option for when you would rather not carry the update chore at all. **Quiz: Is your site covered?** 1. Which Bricksforge version is the minimum to install as of October 12, 2026? - 3.1.8.9 - 3.1.8.10 - 4.0.1 **(correct answer)** - 4.0.0 2. You updated both plugins. What should you do next? - Nothing, because the update removes any planted files - Check users, the uploads folder, changed files, redirects and Search Console **(correct answer)** - Delete WordPress and start again - Wait a month to see if anything happens 3. What does "unauthenticated" mean in CVE-2026-85097? - The attacker needs an administrator login - The attacker does not need to log in **(correct answer)** - The plugin is not licensed - The site uses no password ## Frequently Asked Questions About all in one seo vulnerability **What version of All in One SEO should I install?** Install 5.0.2.1 or newer. It includes the fix for the shortcode flaw (CVE-2026-19856) and the earlier fix from 5.0.2 for the cross-site scripting flaw (CVE-2026-85492). The changelog listed 5.0.3 on October 6, 2026. **Does the Bricksforge issue affect forms without upload fields?** Yes, according to the vendor. The changelog for version 4.0.1 says the fix affects every site with Pro Forms active, including sites whose forms have no upload fields. **Can the All in One SEO shortcode flaw be exploited without logging in?** Yes. The record for CVE-2026-19856 describes it as exploitable by unauthenticated users through search-query input. On sites upgraded from older versions, the protection is switched off, so a crafted request is not even needed. **Is WordPress itself affected?** No. These records describe two third-party plugins, not WordPress core. Keep core updated too, but it is not the product named in them. **Does every vulnerability get a CVE number?** No. The Bricksforge 4.0.1 security fix is listed in the vendor's changelog without a CVE number. When you read a changelog, read the fix notes themselves and do not wait for a CVE before you update. **How do I check my WordPress site for known plugin flaws?** List every plugin and its version, then look each one up in a vulnerability database such as [Patchstack](https://patchstack.com/database/) or the plugin's own changelog, and update anything below a fixed version. Repeat after each new advisory. ## The Bottom Line Check Bricksforge and All in One SEO on your Plugins screen today. Install Bricksforge 4.0.1 or newer first, then All in One SEO 5.0.2.1 or newer, take a backup before you start, and run the damage check afterward. Keep exposed, exploited and compromised separate in your mind, and let your own users, files and logs answer the last one. A fixed flaw stays open on any site that has not installed the fix, and that site is the one taking your leads. A short routine of checking versions each time an advisory appears keeps that from happening for as long as you run WordPress. If you want someone to own those checks, [Web Leveling](https://webleveling.com/) can handle updates and a damage review for you through [website maintenance](https://webleveling.com/services/website-maintenance/), or help you plan a site with fewer parts to patch. Tell us which plugins you run through our [contact page](https://webleveling.com/contact/) and we can go from there. We work with small and medium businesses across the country and overseas. ## Terms Words used in this post Tap a term to see what it means. **CVE.** A public identification number for a specific security flaw, such as CVE-2026-85097. **CVSS.** A 0 to 10 score that rates how severe a flaw could be; it measures potential, not whether a site was attacked. **Unauthenticated.** Able to be done without logging in. **Arbitrary file upload.** A flaw that lets an attacker place a file of their choice on a server. **Cross-site scripting.** A flaw that lets an attacker run script in another user's browser session. **Shortcode.** A small bracketed tag that makes WordPress run a plugin's feature inside a page. - [Ninja Forms Vulnerability: Check Your Version and Update Today](https://webleveling.com/blog/ninja-forms-vulnerability-wordpress-contact-form/): Ninja Forms vulnerability: open Plugins, read your version, back up and update. See which version fixes each flaw, plus the File Uploads add-on. - [Check Your WordPress Host Against the HEIC Image Flaw](https://webleveling.com/blog/check-your-wordpress-host-for-image-library-flaws/): A ten minute check for the WordPress HEIC image vulnerability: what Site Health shows, what to ask your host, and who should be allowed to upload. - [How to Check Your WordPress Plugins for Security Updates](https://webleveling.com/blog/check-wordpress-plugins-for-urgent-security-updates/): Run a WordPress plugin security update check in about ten minutes: list every plugin, match versions to advisories, back up, update safely and spot red flags.