Executive brief
The Blocksy Companion Pro plugin for WordPress, which provides advanced design and e-commerce features, contains a critical security flaw. An unauthenticated attacker can upload malicious files to your website, potentially leading to a complete takeover of the server. This issue specifically affects sites using the premium version with both the Custom Fonts and WooCommerce Extra extensions enabled.
Technical details
The vulnerability exists in the save_attachments function of the Blocksy Companion Pro plugin (up to version 2.1.46). The Custom Fonts extension implements a wp_check_filetype_and_ext filter that uses strpos() to validate file extensions, checking only if '.woff2' or '.ttf' exists anywhere in the filename. This logic allows double-extension bypasses (e.g., 'shell.woff2.php'), which pass MIME validation but are executed as PHP by the server. Exploitation requires the premium version of the plugin with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active.
Affected products
- CreativeThemesHQ Blocksy Companion Pro up to and including 2.1.46
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
References
- https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.46/framework/premium/extensions/custom-fonts/extension.php
- https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.46/framework/premium/extensions/woocommerce-extra/features/advanced-reviews/feature.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2df449b4-3f3b-4afc-b391-8d8d11710c07?source=cve