Uniform is an agentic composable DXP that helps your team ship faster with less patching. It reduces reliance on third-party plugins on your web servers, keeps AI-generated work in drafts and audit trails, and brings your existing content together in one place.
In October 2026, attackers began exploiting CVE-2026-85097, a flaw in the Bricksforge WordPress plugin that lets an unauthenticated request upload arbitrary files and run code on the site. The Hacker News reported the flaw carries the maximum CVSS score of 10.0, and SecurityWeek reported exploitation in the wild from October 7.
Bricksforge for WordPress
CVE-2026-85097
Unauthenticated arbitrary file upload that can lead to code execution
CVSS 10.0, critical
Exploited in the wild from October 7, 2026
CVE-2026-85097 can be triggered without authentication, so an attacker doesn't need an account on the site.
The flaw allows arbitrary files to be uploaded through the Bricksforge plugin onto the server that runs WordPress.
That upload can lead to code execution with the same access as WordPress, and SecurityWeek reported attackers doing exactly that from October 7, 2026. Sites running the vulnerable plugin stay exposed until it is fixed or removed.
Sources
This section covers one widely reported 2026 incident in detail. Severity follows the CVSS base score published in the National Vulnerability Database (NVD).
Much of the risk lives in the plugin and theme layer: third-party PHP running on your servers, with access to your files and database. The Bricksforge flaw above is one example. Every plugin is code your team didn't write but must patch fast. Your team isn't failing; the model is hard to keep safe at scale.
Plugins and themes execute PHP inside WordPress itself. A file-upload flaw in one plugin, like the Bricksforge issue above or the Elementor Pro flaw reported in September 2026, can let an attacker run code on the whole site.
WordPress can force some core updates, but plugin updates still move through staging, regression tests and every site in the estate. SecurityWeek found roughly 3.2 million All-in-One WP Migration sites unpatched as of September 3, 2026.
Attackers began exploiting CVE-2026-87902 in WordPress core within about a day, BleepingComputer reported. Even a weekly patch cycle can't reliably close a window that short.
We respect WordPress and the open-source community behind it. The question isn't whether WordPress is good software. It's whether a plugin-based PHP stack is still the right foundation for a large, multi-site estate that's bringing AI into the workflow.
Uniform, an agentic composable DXP, is a SaaS-managed platform. No third-party plugin code executes PHP on your web servers, so the plugin-upload exploits seen in WordPress in 2026 don't map onto its architecture. That reduces your attack surface; it doesn't eliminate risk. Uniform adds access controls, audit trails and SOC 2 assurance on top.
Roles and permissions scope each person to the projects and actions they need, and project policies set rules per project. Service accounts and API access give integrations their own credentials instead of a shared login. SAML single sign-on ties access to your identity provider.
A 30-day security audit log records security-relevant activity, and Uniform Pulse change history shows who changed what, and with which tool.
Host your project in the US (Virginia) or EU (Frankfurt) data region, and review Uniform's SOC 2 information in the Uniform Trust Center.
What still needs care: your front end is your own application, with its own dependencies and deployment pipeline, and API credentials need the same discipline as any production secret. Uniform keeps the platform layer smaller and better governed.
WordPress is a mature open-source CMS that runs PHP core, themes and plugins on servers you or your host operate. Uniform is an agentic composable DXP, delivered as SaaS, that composes content from many systems. The table compares how each approach handles security, updates, AI agents, multi-source content, governance and scale.
| Area | WordPress (typical self-managed estate) | Uniform | |
|---|---|---|---|
| Security model | Core, themes and plugins run as PHP on servers you or your host operate. Each plugin extends the attack surface. | SaaS-managed platform with no third-party plugin code running PHP on your web servers. Your front end and its dependencies stay yours to maintain. | |
| Update burden | Your team or host applies core, theme and plugin updates per site. WordPress can auto-update some core releases. | Uniform maintains the platform. You update front-end dependencies through your own pipeline. | |
| AI and agent readiness | Available through core features, plugins and custom work; capabilities and guardrails vary by setup. | Scout edits drafts only; MCP server with 30+ tools; Agent Skills and AI guidance for brand voice. | |
| Multi-source content | Content mainly lives in the WordPress database; other sources usually connect through plugins or custom code. | Composes content from systems you already have through 45+ integrations. | |
| Governance | Roles and capabilities in core; SSO, audit logs and approval flows usually come from plugins. | Roles and permissions, project policies, SAML SSO, 30-day security audit log, Uniform Pulse change history. | |
| Scaling | Scale with hosting capacity, caching and multisite; every added site adds patch work. | Edge and CDN delivery; add brands, markets and sources inside one platform. |
About this comparison
WordPress setups vary widely by host and plugin choice. This table describes a typical self-managed, plugin-heavy estate; managed WordPress hosts may take on some of the update work.
Enterprise teams use Uniform, an agentic composable DXP, to ship across many sites, markets and content sources from one governed platform. These customer stories show what that looks like in production.
Explore all customer storiesTelcoCanada$1.1M ROI and 60x developer efficiency
Composable DXP, orchestration
Read the storyFinanceUnited StatesPersonalized sessions from 4% to 82% in two months
Personalization, edge delivery
Read the storyTechnologyEMEAA/B testing, personalization
Read the story
HealthcareUnited StatesPhased migration, orchestration
Read the story"Traditional platforms scale with headcount. Agentic platforms scale with compute."
These answers cover what technical and marketing leaders ask most when weighing WordPress security against a move to Uniform, an agentic composable DXP: whether WordPress is still safe, which alternatives fit enterprise sites, how AI agents are governed and what a migration from WordPress involves.
WordPress can be run safely, and the WordPress security team ships fixes quickly. The challenge is operational. In 2026, critical flaws in WordPress core and popular plugins were exploited soon after disclosure, one within about a day. Plugin-heavy estates need fast, disciplined patching on every site, or less third-party PHP. See how the Bricksforge exploit worked.
Bring your plugin inventory and the questions your security team keeps asking. We'll show you how Uniform, an agentic composable DXP, would handle them, and talk through what a move off WordPress would really take.
Sites, plugins, integrations and the update work that fills your week.
Security controls, governed agents and composition, shown against what you run today.
A realistic view of what a phased move off WordPress would involve.
Planning a migration? Talk to us about your WordPress migration or review how Uniform handles security.
.svg){kind=icon}
.jpg)
