CVE Feed

    Dashboard / CVE / CVE-2026-58480

    CVE-2026-58480

    Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.

    Published:Jul 8, 2026
    Last Modified:Jul 14, 2026
    EPS:Jul 8, 2026
    EPSS Score:0.00605
    CVSS Score:9.8

    Affected Products

    Vendor
    Creativethemes
    Product
    Blocksy Companion
    Vendor
    Wordpress
    Product
    Wordpress

    Exploits

    https://www.exploit-db.com/exploits/52640https://github.com/shinthink/CVE-2026-58480

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2026-18488 (CVSS 6.4) — The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block At…
    CVE-2026-57630 (CVSS 5.3) — Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.…
    CVE-2026-57315 (CVSS 8.5) — Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.…
    CVE-2026-12430 (CVSS 4.4) — The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in …
    CVE-2026-40783 (CVSS 9.9) — Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.…
    CVE-2026-39596 (CVSS 9.3) — Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.…
    CVE-2025-12846 (CVSS 8.8) — The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all version…
    CVE-2025-12475 (CVSS 6.4) — The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bloc…
    CVE-2025-9565 (CVSS 6.4) — The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block…
    CVE-2024-35633 (CVSS 4.4) — Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This i…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High