Junglewise Threat Intelligence

CVE-2026-8365: CreativeThemes Blocksy PHP Object Injection in blocksy_meta REST API field

CVE-2026-8365 · Severity: high · CVSS 8.8 · Published 2026-06-09

Executive brief

The Blocksy theme for WordPress, a popular tool for designing and customizing websites, contains a security flaw that could allow an attacker to take full control of a site. By exploiting a weakness in how the theme handles data during database updates, an authorized user with basic contributor permissions can execute malicious code on the server. This could lead to complete site takeover, data theft, or the installation of malware.

Technical details

The vulnerability exists due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which fails to prevent serialized PHP object strings from being stored in post meta. This is combined with a flaw in the SearchReplacer::run_recursively() function, which unconditionally deserializes string values via @unserialize() during the V200 database migration without restricting allowed classes. An authenticated attacker with contributor-level access or higher can inject a serialized Blocksy\RaiiPattern object into post meta. When the migration process runs, the object is deserialized, triggering the __destruct() magic method and executing arbitrary PHP callables via call_user_func(). The issue is addressed in versions following 2.1.35.

Affected products

  • CreativeThemes Blocksy up to and including 2.1.35

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory

References