PT-2025-46324 · WordPress · Blocksy Companion

Angus Girvan · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12846

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blocksy Companion plugin for WordPress versions up to and including 2.1.19

Description The Blocksy Companion plugin for WordPress is susceptible to authenticated arbitrary file upload due to insufficient file type validation. Specifically, the plugin fails to properly detect SVG files, allowing files with double extensions to bypass sanitization. This enables authenticated attackers with author-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution. The file parameter in the upload process is vulnerable.

Recommendations Update the Blocksy Companion plugin to a version later than 2.1.19.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12846

Affected Products

Blocksy Companion

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12846 · Security Note
• https://t.me/cveNotify/142397 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f8615422-5db7-495d-9956-7d6f658f42bf?source=cve · Note
• https://twitter.com/CVEnew/status/1988210486400430361 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988319145415373244 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3391933/blocksy-companion/trunk/framework/features/svg.php · Note
• https://t.me/CVEtracker/37025 · Telegram Post
• https://twitter.com/CveFindCom/status/1988210239334711596 · Twitter Post