What is the CVSS score of CVE-2026-57315?

CVE-2026-57315 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Blocksy Companion Pro are affected by CVE-2026-57315?

Blocksy Companion Pro (versions 2.1.45 and earlier) contains a critical remote code execution vulnerability that enables users with Contributor-level access to inject and execute arbitrary PHP code…

How to fix or mitigate CVE-2026-57315?

Within 24 hours: Disable Blocksy Companion Pro or restrict Contributor role to only essential, trusted personnel; audit all active Contributor accounts for suspicious activity. Within 7 days: Analyze server logs for evidence of PHP code injection or malicious execution; investigate any Contributor account activity in plugin administration. Within 30 days: Monitor Blocksy and Patchstack advisories for patch release; prepare upgrade deployment plan to deploy patched versions immediately upon release.

Blocksy Companion Pro CVE-2026-57315

EUVD-2026-39728 HIGH

Code Injection (CWE-94)

2026-06-26 audit@patchstack.com

GHSA-vj4f-3p4c-m596

WordPress RCE Code Injection Wordpress Plugin

8.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network-reachable but needs a Contributor account (PR:L) and specific conditions (AC:H); PHP RCE crosses into the host process (S:C) yielding full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:53 vuln.today

DescriptionCVE.org

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.

AnalysisAI

Remote code execution in Blocksy Companion Pro (the premium add-on plugin for the Blocksy WordPress theme) versions 2.1.45 and earlier allows authenticated users holding only the low-privilege Contributor role to inject and execute arbitrary PHP code on the host. The flaw, reported by Patchstack and tracked under CWE-94, carries a CVSS 3.1 base score of 8.5 with a changed scope, meaning successful exploitation can impact components beyond the WordPress application itself. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; no EPSS score was provided in the source data.

Technical ContextAI

Blocksy Companion Pro is a commercial WordPress plugin that extends the popular free Blocksy theme with premium features (custom post types, content blocks, mega menus, extensions, etc.). The vulnerability is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), indicating that attacker-controlled input reaches a PHP execution sink - typically through unsafe handling of dynamic blocks, shortcodes, template/widget rendering, or serialized option data that the plugin evaluates. Because WordPress runs plugin PHP within the same process as the web application, injected code executes with the privileges of the PHP/web-server worker, which the CVSS 'Scope: Changed' designation reflects as impact extending past the vulnerable component's own security authority.

RemediationAI

Upgrade Blocksy Companion Pro to a version newer than 2.1.45 once the vendor releases it; the source data does not include an exact fixed version number, so confirm the patched release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/blocksy-companion-pro/vulnerability/wordpress-blocksy-companion-pro-plugin-2-1-45-remote-code-execution-rce-vulnerability?_s_id=cve) and the Blocksy vendor channel before deploying. As compensating controls until patched: audit and minimize Contributor-and-above accounts, revoking or downgrading any that do not strictly need authoring rights, since the attack requires an authenticated low-privilege account; disable open/self-service registration that grants Contributor capability; and place the site behind a WordPress-aware WAF or Patchstack virtual patch to block the code-injection payload. The trade-off of restricting Contributor accounts is reduced multi-author functionality, and WAF virtual patching may not cover every exploit variant, so it should be treated as interim mitigation rather than a substitute for the vendor fix.