Is CVE-2026-39596 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39596 being exploited in the wild.

How severe is CVE-2026-39596?

Critical severity, with a CVSS score of 9.3, published 17 June 2026.

Which products and versions are affected?

Creative Themes Blocksy Companion Pro < 2.1.29.

Is there a fix for CVE-2026-39596?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39596 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39596?

Check whether you run Creative Themes Blocksy Companion Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39596: Creative Themes Blocksy Companion Pro SQL injection

Q: Is there a fix for CVE-2026-39596?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-39596 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-39596?

Check whether you run Creative Themes Blocksy Companion Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39596 · Severity: critical · CVSS 9.3 · Published 2026-06-17

Blocksy Companion Pro, a premium WordPress plugin used to extend the functionality of the Blocksy theme, contains a critical security flaw. An unauthenticated attacker can remotely access and manipulate the website's database. This could lead to the theft of sensitive customer information, administrative account takeover, or disruption of site operations.

Technologies: Creative Themes Blocksy Companion Pro. Vendors: Creative Themes.

Quick answers

Is CVE-2026-39596 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39596 being exploited in the wild.
How severe is CVE-2026-39596?: Critical severity, with a CVSS score of 9.3, published 17 June 2026.
Which products and versions are affected?: Creative Themes Blocksy Companion Pro < 2.1.29.
Is there a fix for CVE-2026-39596?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39596 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39596?: Check whether you run Creative Themes Blocksy Companion Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the Blocksy Companion Pro plugin for WordPress due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw allows an unauthenticated remote attacker to send specially crafted requests to the application to interact directly with the underlying database. Successful exploitation can lead to unauthorized data exfiltration, modification of database records, or partial denial of service. The vulnerability is addressed in version 2.1.29.

Affected products

Creative Themes Blocksy Companion Pro < 2.1.29

Timeline

2026-02-03: other: Vulnerability reported by Nguyen Ba Khanh
2026-04-08: disclosed: Initial disclosure by Patchstack
2026-06-17: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.