CVE-2026-58480: Blocksy Companion Pro plugin Remote code execution

CVE-2026-58480 is a critical severity vulnerability (CVSS 9.8) identified in the National Vulnerability Database. Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring

TL;DR: This is a remote code execution vulnerability (CVSS 9.8 CRITICAL). Authentication: Not required (unauthenticated). Patch immediately.

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.

The National Vulnerability Database assigned this issue a CVSS base score of 9.8 , placing it in the CRITICAL category. The identifier CVE-2026-58480 was published on 2026-07-08T14:17:19.977.

Based on the vulnerability data published by NVD, the following products and configurations are identified as affected:

If your organization uses any of the above, this vulnerability applies to your environment. Even if your specific version is not listed, review the full CPE match data to confirm.

Illustrative patterns for defensive detection. Not a working exploit.

File upload attacks place executable content in web-accessible directories. Watch for:

Here is what we recommend, in order of priority:

Run as administrator. Collect artifacts before applying patches or making changes:

If you need help analyzing these artifacts, call Sherlock Forensics at 604.229.1994 .

A CVSS score of 9.8 means this vulnerability is straightforward to exploit, likely to cause significant damage or both. For startups and small companies operating without a dedicated security team, vulnerabilities at this severity level represent real operational risk rather than theoretical concern.

The challenge is not awareness. Vulnerability databases are public. The challenge is triage: understanding whether a given CVE affects your specific stack and knowing what to do it before an attacker does. If you lack the internal capacity to perform that assessment, an external review of your exposure is a concrete step.

Sherlock Forensics provides vulnerability assessment and penetration testing for organizations that need to understand their attack surface without building a full internal security function.