PT-2026-56414 · WordPress · Blocksy Companion Pro

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-58480

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47

Description An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The save attachments() function fails to properly validate file extensions, specifically due to a flawed strpos() substring check in the Custom Fonts extension. An attacker can bypass this validation by using double-extension filenames, such as shell.woff2.php, allowing the upload of executable files that the web server processes as PHP, leading to remote code execution.

Recommendations Update Blocksy Companion Pro plugin for WordPress to version 2.1.47 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-58480

Affected Products

Blocksy Companion Pro

References · 6

• https://wordpress.org/plugins/blocksy-companion · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58480 · Security Note
• https://patchstack.com/database/wordpress/plugin/blocksy-companion/vulnerability/wordpress-blocksy-companion-plugin-2-1-46-unauthenticated-arbitrary-file-upload-vulnerability · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/blocksy-companion/blocksy-companion-2146-unauthenticated-arbitrary-file-upload-via-blc-review-images-parameter · Note
• https://vulncheck.com/advisories/blocksy-companion-pro-unauthenticated-file-upload-via-save-attachments · Note
• https://twitter.com/OrizonCyber/status/2074886245386244583 · Twitter Post