EUVD-2026-42233
GHSA-r58f-77hp-phcj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network file-upload RCE (AV:N/PR:N/UI:N) with full CIA impact, but AC:H reflects the required PHP-execution-in-uploads server condition (AT:P in 4.0).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
Articles & Coverage 2
AnalysisAI
Remote code execution in the Blocksy Companion Pro WordPress plugin (all versions before 2.1.47) lets unauthenticated attackers upload executable PHP files through the Advanced Reviews feature, taking over the site. The save_attachments function relies on a flawed strpos() substring check inherited from the Custom Fonts extension, so a double-extension filename like shell.woff2.php passes validation while the server executes it as PHP. No public exploit has been identified at time of analysis, but a vendor patch (2.1.47) is available and the flaw was reported by VulnCheck.
Technical ContextAI
The affected component is a commercial WordPress plugin (CPE cpe:2.3:a:creative_themes:blocksy_companion) that extends the widely used Blocksy theme with modules including Advanced Reviews and Custom Fonts. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the save_attachments routine validates uploaded filenames using strpos(), a substring search that returns true whenever an allowed token (e.g. 'woff2') appears anywhere in the name rather than anchoring on the final extension. Because PHP is dispatched by the web server based on the trailing .php extension, a name such as shell.woff2.php satisfies the substring allow-list yet is still executed as server-side code, converting a font-upload feature into an arbitrary code execution primitive.
RemediationAI
Vendor-released patch: upgrade Blocksy Companion (Pro) to version 2.1.47 or later, available via https://wordpress.org/plugins/blocksy-companion/ and the vendor/VulnCheck advisory. If immediate patching is not possible, restrict exposure of the Advanced Reviews / review-image upload endpoint (the blc-review-images parameter path) - for example deny unauthenticated POSTs to it at the WAF or reverse proxy - and configure the web server to refuse PHP execution within the plugin's uploads/attachments directory (e.g. an .htaccess or nginx location rule that disables the PHP handler for wp-content uploads), which neutralizes the double-extension trick at the cost of breaking any legitimate script that expects execution from that path. Consider temporarily disabling the Advanced Reviews or Custom Fonts extensions if unused, accepting the loss of those features until 2.1.47 is deployed. Reference the Wordfence and Patchstack advisories above for detection signatures.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today