PT-2026-47723 · WordPress · Blocksy
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Blocksy versions prior to 2.1.36
Description
Insufficient input sanitization in the
blocksy sanitize post meta options() function allows authenticated attackers with contributor-level access or higher to store serialized PHP object strings in post meta. The function only blocks values containing '<' or '>', failing to prevent the injection of serialized objects. When the V200 database migration occurs, the SearchReplacer::run recursively() function unconditionally deserializes all string values using @unserialize() without restricting allowed classes. This process can trigger the RaiiPattern:: destruct() function of an injected BlocksyRaiiPattern object, leading to remote code execution by executing arbitrary PHP callables via call user func(). This issue is accessible via the 'blocksy meta' REST API field.Recommendations
Update to version 2.1.36 or later.
As a temporary mitigation, restrict access to the 'blocksy meta' REST API field for users with contributor-level permissions.
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Blocksy