EUVD-2026-42549
GHSA-hhjp-58g7-3jr8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote file upload yields code execution with full C/I/A impact; the pro/extension requirement is a deployment precondition, not attack complexity, so AC:L and PR:N stand.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that approves any filename containing .woff2 or .ttf as a substring via strpos() rather than validating that those strings appear as the final extension via PATHINFO_EXTENSION - allowing double-extension filenames such as shell.woff2.php to pass MIME validation and be handled as permitted font files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable when the premium version of the plugin (blocksy-companion-pro) is installed with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active; the free blocksy-companion plugin does not contain the vulnerable code paths.
Articles & Coverage 1
AnalysisAI
Arbitrary file upload leading to remote code execution affects the premium Blocksy Companion Pro plugin for WordPress in all versions through 2.1.46, where the Custom Fonts extension's flawed MIME validation lets unauthenticated attackers upload executable PHP files disguised as fonts. The Custom Fonts extension registers a wp_check_filetype_and_ext filter that uses strpos() to approve any filename merely containing '.woff2' or '.ttf' anywhere in the string, so a double-extension payload like shell.woff2.php passes as a legitimate font. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type). WordPress normally gates uploads through the wp_check_filetype_and_ext filter, which is supposed to confirm a file's real extension and MIME type. The Custom Fonts extension (framework/premium/extensions/custom-fonts/extension.php around line 137) hooks this filter but validates the filename with strpos(), a substring search, instead of PHP's pathinfo() with PATHINFO_EXTENSION, which would isolate the true final extension. Because strpos() matches '.woff2' or '.ttf' as a substring anywhere in the name, a filename such as shell.woff2.php satisfies the check while the operating system and web server still treat the terminal .php as the executable extension. The upload is driven through the save_attachments function in the WooCommerce Extra Advanced Reviews feature (feature.php around line 811), which is where attacker-controlled files enter. Affected code is identified by CPE cpe:2.3:a:creativethemeshq:blocksy_companion:*:*:*:*:*:*:*:*.
RemediationAI
No vendor-released patched version was identified in the provided data, so no exact fix version can be cited; monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2df449b4-3f3b-4afc-b391-8d8d11710c07?source=cve) and the Creative Themes HQ changelog for a release above 2.1.46 and upgrade immediately once available. As specific compensating controls until a patch is confirmed, deactivate the Custom Fonts extension (removes the flawed wp_check_filetype_and_ext filter and closes the primary vector, at the cost of custom font uploads) or deactivate the WooCommerce Extra Advanced Reviews feature that exposes save_attachments (disables customer review attachments); either alone breaks the exploit chain. Additionally, configure the web server to refuse PHP execution within the WordPress uploads directory (e.g., an Nginx location or Apache <Directory> rule denying execution of .php under wp-content/uploads), which neutralizes double-extension payloads with minimal functional impact, and place a WAF rule to block uploads whose filenames contain a font extension followed by an executable extension.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today