EUVD-2026-39746
GHSA-ffhf-8563-gffw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:N and PR:N confirmed by unauthenticated network exploitation; C:L only as IDOR exposes objects without write access; I:N and A:N as no modification or denial-of-service vector described.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.
AnalysisAI
Unauthenticated IDOR in Blocksy Companion Pro WordPress plugin (versions through 2.1.46) allows remote unauthenticated attackers to access restricted objects by manipulating user-controlled reference keys, resulting in unauthorized information disclosure. The CVSS 5.3 Medium score reflects network-reachable, zero-authentication access (AV:N/AC:L/PR:N/UI:N) but limited confidentiality impact only (C:L/I:N/A:N). No active exploitation has been confirmed (not listed in CISA KEV), and no EPSS data was provided, though the trivial exploitation complexity elevates practical risk above the moderate score suggests.
Technical ContextAI
CWE-639 (Authorization Through User-Controlled Key) describes a root cause where an application uses an attacker-supplied value - such as a numeric ID, slug, or UUID - to locate and return an object without verifying the requesting party's authorization to access that specific object. In the WordPress plugin context, this typically manifests in REST API endpoints or admin-ajax handlers where the plugin retrieves records, files, or settings by a reference parameter supplied in the HTTP request. Blocksy Companion Pro is the premium feature-extension plugin for the Blocksy WordPress theme, and is expected to handle page builder blocks, widget data, and potentially premium content or user-specific configuration objects. No CPE string was provided in the source data, so the affected scope is defined solely by the vendor version range: Blocksy Companion Pro n/a ≤ 2.1.46.
RemediationAI
Upgrade Blocksy Companion Pro to a version beyond 2.1.46 as the primary remediation. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/blocksy-companion-pro/vulnerability/wordpress-blocksy-companion-pro-plugin-2-1-46-insecure-direct-object-references-idor-vulnerability) should be consulted for the confirmed fixed version, as no exact patched release number was present in the available source data - the fix version is not independently confirmed at time of analysis. As a compensating control prior to patching, consider using a WordPress security firewall (e.g., Wordfence, Patchstack WAF) to block anomalous object reference requests to plugin endpoints; however, WAF-based mitigations for IDOR are inherently imprecise and should not substitute for patching. If the plugin's affected feature can be identified and disabled without breaking site functionality, disabling it temporarily reduces exposure. Restricting wp-admin and REST API access by IP allowlist is an additional layer but may not be feasible for all deployments.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today