What is the CVSS score of CVE-2026-39596?

CVE-2026-39596 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Blocksy Companion Pro are affected by CVE-2026-39596?

Blocksy Companion Pro contains a critical unauthenticated SQL injection vulnerability (CVSS 9.3) allowing remote attackers to directly access sensitive database contents without authentication.. A patch is available.

How to fix or mitigate CVE-2026-39596?

24 hours: Audit all WordPress environments to identify Blocksy Companion Pro installations and document current versions. 7 days: Implement interim controls including disabling the plugin on non-production sites, restricting database access to minimum required connections, and deploying WAF rules to block SQL injection patterns. 30 days: Upon vendor release of version 2.1.29, immediately upgrade all affected instances and conduct database integrity review for injection artifacts.

Blocksy Companion Pro CVE-2026-39596

EUVD-2026-37589 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Blocksy Companion Pro Creative Themes

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N); scope changes as DB engine acts on attacker input (S:C); full DB read (C:H), limited write via INSERT/UPDATE chains (I:L), no inherent availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:20 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

AnalysisAI

Unauthenticated SQL injection in Blocksy Companion Pro (a premium WordPress plugin from Creative Themes) prior to version 2.1.29 allows remote attackers to inject arbitrary SQL into backend database queries without any login or user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) with scope-change indicates the impact crosses a security boundary, with full confidentiality compromise of database contents and limited integrity/availability effect. No public exploit identified at time of analysis, but the vulnerability class and SSDLC profile are highly attractive to automated scanners targeting WordPress.

Technical ContextAI

Blocksy Companion Pro is the commercial companion plugin to the popular Blocksy WordPress theme by Creative Themes, adding features such as custom post types, header/footer builder elements, white-label, and content blocks. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input reaches a database query - typically via WordPress's $wpdb interface - without proper use of $wpdb->prepare() or sanitization helpers like esc_sql() or intval(). The scope-changed CVSS vector (S:C) suggests the injectable parameter is reachable from an endpoint that operates with higher database privileges than the unauthenticated caller, characteristic of an AJAX action or REST route registered without a capability check. The affected CPE (cpe:2.3:a:creative_themes:blocksy_companion_pro:*) covers all versions below 2.1.29.

RemediationAI

Vendor-released patch: upgrade Blocksy Companion Pro to version 2.1.29 or later via the Creative Themes account dashboard or the plugin's built-in license-bound updater, as indicated by the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/blocksy-companion-pro/vulnerability/wordpress-blocksy-companion-pro-plugin-2-1-29-sql-injection-vulnerability. If immediate patching is not possible, deactivate Blocksy Companion Pro until the upgrade can be deployed - note this will disable Pro-only features such as the header/footer builder extensions, custom post types, and white-label settings while it is off. Alternatively, deploy a WAF rule (Patchstack, Wordfence, Cloudflare WordPress ruleset) that blocks SQL meta-characters on the affected plugin's admin-ajax and REST endpoints; this provides virtual patching but can produce false positives on legitimate admin requests, so restrict the rule to anonymous sessions where feasible. Audit wp_users, wp_options (siteurl, secret keys), and recent post revisions for tampering before assuming the site was not already probed.