What the vulnerability does
01Description
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
Explanation of Vulnerability in Simple Terms
02Summary
Blocksy Companion versions up to 2.1.46 allow unauthenticated attackers to upload files without restriction. An attacker can upload malicious files to the site, potentially including PHP code or other executable content. This vulnerability requires no user interaction and can be exploited over the network.
What an attacker can do
03Attacker Capabilities
Upload malicious files (including PHP code) to the site without authentication.
Potential impact on your site
04Site Impact
Attackers can upload and execute malicious code, leading to full site compromise and data theft.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 8, 2026
CVE published
July 8, 2026
Record updated
