Blocksy Companion CVE-2026-15158

Exploitation requires the premium blocksy-companion-pro plugin to be installed AND both the WooCommerce Extra (Advanced Reviews) extension and the Custom Fonts extension to be active simultaneously - the free blocksy-companion plugin is not affected. The concrete trigger is the save_attachments upload path in the Advanced Reviews feature combined with the Custom Fonts extension's wp_check_filetype_and_ext filter, which approves any filename containing '.woff2' or '.ttf' as a substring, allowing double-extension files such as shell.woff2.php. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, but the pro-plus-two-extensions requirement is a non-default configuration that meaningfully limits the exploitable population; the payload also depends on the server being willing to execute PHP from the upload location.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact - consistent with unauthenticated RCE via arbitrary file upload. However, the raw 9.8 overstates realistic exposure because exploitation is gated on a specific non-default configuration: the paid Blocksy Companion Pro must be installed with BOTH the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active; the far more common free plugin lacks the vulnerable code entirely. No EPSS score, KEV entry, or public POC was provided, so there is no evidence of active exploitation or automated weaponization at this time - the signal is a credible Wordfence code-level finding, not observed attacks. Net assessment: genuinely high severity where the vulnerable pro/extension combination is deployed, but the affected population is narrower than the network-unauthenticated vector alone implies, making this a prioritized patch for affected sites rather than an internet-wide emergency.

An unauthenticated attacker locates a WordPress site running Blocksy Companion Pro with the Advanced Reviews and Custom Fonts extensions active, then submits a product review attachment named shell.woff2.php containing PHP code. The save_attachments handler passes the file through the Custom Fonts filter, whose strpos() substring check sees '.woff2' and approves it, writing the file to the server; the attacker then requests the uploaded .php file to execute arbitrary code. No public POC is currently identified, but the low attack complexity and lack of authentication make reliable exploitation straightforward once the vulnerable configuration is found.