Executive brief
Blocksy Companion is a popular WordPress plugin used to add advanced design features and starter sites to websites. A critical security flaw allows unauthenticated visitors to upload malicious files to the server. This could allow an attacker to take complete control of the website, steal sensitive data, or disrupt operations.
Technical details
The Blocksy Companion Pro plugin for WordPress (versions prior to 2.1.47) is vulnerable to unauthenticated arbitrary file uploads due to insufficient validation in the save_attachments function. The vulnerability stems from a flawed strpos() substring check within the Custom Fonts extension's validation logic. An attacker can bypass security filters by using double-extension filenames (e.g., 'shell.woff2.php'). While the validation logic incorrectly identifies the file as a legitimate font based on the substring match, the web server processes the final .php extension, allowing for remote code execution (RCE). The issue is resolved in version 2.1.47.
Affected products
- Creative Themes Blocksy Companion < 2.1.47
Timeline
- 2026-07-02: disclosed: Vulnerability published by Patchstack
- 2026-06-24: patched: Version 2.1.47 released to address the issue
- 2026-07-08: advisory: CVE-2026-58480 published to the NVD
References
- https://patchstack.com/database/wordpress/plugin/blocksy-companion/vulnerability/wordpress-blocksy-companion-plugin-2-1-46-unauthenticated-arbitrary-file-upload-vulnerability
- https://wordpress.org/plugins/blocksy-companion/
- https://www.vulncheck.com/advisories/blocksy-companion-pro-unauthenticated-file-upload-via-save-attachments
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/blocksy-companion/blocksy-companion-2146-unauthenticated-arbitrary-file-upload-via-blc-review-images-parameter