CVE-2026-58480
Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
CVSS Score
9.8
EPSS Score
0.6%
EPSS Percentile
45th
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
| CWE | CWE-434 |
| Vendor | creative themes |
| Product | blocksy companion |
| Published | Jul 8, 2026 |
| Last Updated | Jul 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for creative themes blocksy companion
Be the first to know when new critical vulnerabilities affecting creative themes blocksy companion are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Creative Themes / Blocksy Companion
0 ≤ 2.1.46
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/blocksy-companion/blocksy-companion-2146-unauthenticated-arbitrary-file-upload-via-blc-review-images-parameter patchstack.com: https://patchstack.com/database/wordpress/plugin/blocksy-companion/vulnerability/wordpress-blocksy-companion-plugin-2-1-46-unauthenticated-arbitrary-file-upload-vulnerability wordpress.org: https://wordpress.org/plugins/blocksy-companion/ vulncheck.com: https://www.vulncheck.com/advisories/blocksy-companion-pro-unauthenticated-file-upload-via-save-attachments
Credits
Nguyen Ba Khanh