What is the CVSS score of CVE-2026-40783?

CVE-2026-40783 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Blocksy Companion Pro are affected by CVE-2026-40783?

Blocksy Companion Pro, a widely-deployed WordPress plugin, contains a critical remote code execution vulnerability (CVE-2026-40783, CVSS 9.9) affecting versions 2.1.37 and earlier with no vendor…

How to fix or mitigate CVE-2026-40783?

Within 24 hours: Inventory all WordPress installations running Blocksy Companion Pro 2.1.37 or earlier; review recent access logs for indicators of compromise; document all active Contributor-level WordPress user accounts. Within 7 days: Implement interim protection by either disabling the plugin (if operationally feasible) or restricting WordPress admin panel access to whitelisted IP ranges. Within 30 days: Monitor Blocksy/Creative Themes and Patchstack for patch release; schedule and execute plugin upgrade to patched version immediately upon availability.

Blocksy Companion Pro CVE-2026-40783

EUVD-2026-37605 CRITICAL

Code Injection (CWE-94)

2026-06-17 Patchstack

WordPress RCE Code Injection Wordpress Plugin Blocksy Companion Pro Creative Themes

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable WordPress endpoint (AV:N/AC:L), Contributor role required (PR:L), no interaction (UI:N), PHP code execution breaks WordPress app boundary into host (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:12 vuln.today

DescriptionCVE.org

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.

AnalysisAI

Remote code execution in Blocksy Companion Pro (Creative Themes) versions 2.1.37 and earlier allows authenticated users with Contributor-level WordPress privileges to inject and execute arbitrary code on the underlying server. The flaw carries a CVSS 3.1 base score of 9.9 with scope change, reflecting that successful exploitation breaks out of the WordPress application context. No public exploit identified at time of analysis, but Patchstack has catalogued the issue in its WordPress vulnerability database.

Technical ContextAI

Blocksy Companion Pro is a premium WordPress plugin from Creative Themes that extends the Blocksy theme with site-building features such as custom post types, header/footer builders, and content blocks. The root cause is CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), which typically arises in WordPress plugins when user-supplied input is passed into shortcode handlers, template rendering helpers, or eval/include-style sinks without proper sanitization. The CPE cpe:2.3:a:creative_themes:blocksy_companion_pro:*:*:* indicates all versions through 2.1.37 are in scope across deployments.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data - administrators should upgrade Blocksy Companion Pro to the next release after 2.1.37 as published by Creative Themes and monitor https://patchstack.com/database/wordpress/plugin/blocksy-companion-pro/vulnerability/wordpress-blocksy-companion-pro-plugin-2-1-37-remote-code-execution-rce-vulnerability for the exact fixed version. Until patched, restrict who can hold the Contributor role (remove untrusted authors, disable open registration that defaults to Contributor), or temporarily deactivate Blocksy Companion Pro accepting the trade-off of losing its site-building features. A WordPress WAF such as Patchstack or Wordfence with a virtual patch for this CVE can also block exploitation, at the cost of an additional dependency and potential false positives on legitimate editor activity.