Back patchstack.com

Wordpress Blocksy Companion Plugin 2 1 46 Unauthenticated Arbitrary File Upload Vulnerability

patchstack.com • July 9, 2026

As immediate action, update the affected plugin. If you're unable to do so, ask your hosting provider or web developer for help.

This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

We advise to mitigate or resolve the vulnerability immediately.

Patchstack has issued a mitigation rule to block any attacks until you have updated to a patched version.

Update to version 2.1.47 or later to resolve the vulnerability. Patchstack users can turn on auto-update for vulnerable plugins only.

Published by Patchstack

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Blocksy Companion Pro Plugin Discovered A critical vulnerability, CVE-2026-58480, has been identified in the Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47. This unauthenticated arbitrary file upload vulnerability allows attackers to upload executable files by bypassing extension validation through the Advanced Reviews feature. Exploitation can occur via the Custom Fonts extension's flawed strpos() check, enabling remote code execution when double-extension filenames like shell.woff2.php are uploaded. The vulnerability has a CVSS score of 9.8, indicating a severe risk for organizations using affected versions. Users are advised to patch immediately to mitigate potential exploitation. The CVE was published on 2026-07-08, and organizations are urged to assess their exposure to this critical flaw. 2 sources 78

Extracted Entities

Wordpress Blocksy Companion Plugin 2 1 46 Unauthenticated Arbitrary File Upload Vulnerability

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)