Sherlockforensics Critical RCE Vulnerability in Blocksy Companion Pro Plugin Discovered
Article Content
- •CVE-2026-58480 is a critical RCE vulnerability with a CVSS score of 9.8.
- •The vulnerability affects Blocksy Companion Pro plugin for WordPress versions before 2.1.47.
- •Attackers can exploit the flaw to upload malicious files without authentication.
A critical vulnerability, CVE-2026-58480, has been identified in the Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47. This unauthenticated arbitrary file upload vulnerability allows attackers to upload executable files by bypassing extension validation through the Advanced Reviews feature. Exploitation can occur via the Custom Fonts extension's flawed strpos() check, enabling remote code execution when double-extension filenames like shell.woff2.php are uploaded. The vulnerability has a CVSS score of 9.8, indicating a severe risk for organizations using affected versions. Users are advised to patch immediately to mitigate potential exploitation. The CVE was published on 2026-07-08, and organizations are urged to assess their exposure to this critical flaw.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-58480 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to… 
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…