Blocksy Companion Pro CVE-2026-58480

Exploitation requires the target to be running Blocksy Companion Pro before 2.1.47 with the Advanced Reviews feature exposed (the save_attachments upload path reachable via the blc-review-images parameter), and - reflected in the CVSS AT:P flag - the web server must be configured to execute PHP files from the plugin's upload/attachments directory, which is the default on most WordPress/LAMP deployments but can be disabled. No authentication is required (PR:N) and no user interaction is needed (UI:N). The main limiting factors are the non-universal PHP-in-uploads execution requirement and having the vulnerable extension/feature enabled; sites that block PHP execution in wp-content/uploads or that do not use Advanced Reviews are not exploitable via this path.

This is a genuine high-priority issue rather than a high-score-low-risk case. The CVSS 4.0 base score is 9.2 with vector AV:N/AC:L/PR:N/UI:N and high confidentiality, integrity and availability impact on the vulnerable system, meaning unauthenticated network exploitation yielding full site compromise. The one moderating signal is AT:P (attack requirements present): successful RCE depends on the web server executing PHP from the plugin's upload path, which is typical of default LAMP/WordPress stacks but not universal. There is no CISA KEV listing and no confirmed public POC, so exploitation is not yet demonstrated in the wild; EPSS was not provided. The balance of an unauthenticated file-upload-to-RCE class bug, a reputable reporter (VulnCheck), and public advisories from Wordfence and Patchstack means weaponization is realistically expected, so treat it as urgent despite the absence of KEV/POC confirmation.

An attacker sends an unauthenticated HTTP POST to the plugin's review-image upload endpoint carrying a file named shell.woff2.php whose body contains PHP code; the strpos() check sees 'woff2' and accepts it. The attacker then requests the stored file's URL, the web server executes the embedded PHP, and the attacker gains remote code execution and full control of the WordPress site. No public POC is currently identified, but the technique is straightforward given the described substring-validation flaw.