EUVD-2026-35379
GHSA-r622-c48h-h6qq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '<' or '>' and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().
Articles & Coverage 2
AnalysisAI
Authenticated PHP Object Injection in the Blocksy WordPress theme (versions ≤ 2.1.35) allows contributor-level users to escalate to remote code execution by storing a malicious serialized object in post meta that is later deserialized during the V200 database migration. Wordfence-reported flaw chains weak input sanitization in blocksy_sanitize_post_meta_options() with an unconditional @unserialize() call in SearchReplacer::run_recursively(), triggering RaiiPattern::__destruct() to invoke arbitrary callables via call_user_func(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account at contributor level or above on a site running the Blocksy theme version ≤ 2.1.35 with the 'blocksy_meta' REST API field writable to that role; the attacker must additionally wait for (or induce) execution of the V200 database migration, which runs during a theme/database upgrade, to trigger the @unserialize() sink in SearchReplacer::run_recursively(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scoring 8.8 reflects network-reachable, low-complexity exploitation requiring only low privileges, with no user interaction and full confidentiality/integrity/availability impact - appropriate for a contributor-to-RCE chain on a CMS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a contributor-level WordPress account on a target site running Blocksy ≤ 2.1.35, then uses the REST API to write a crafted serialized Blocksy\RaiiPattern object into the 'blocksy_meta' post meta field of a draft post - the sanitizer accepts it because the payload contains no '<' or '>' characters. When the site administrator subsequently upgrades Blocksy and the V200 migration executes SearchReplacer::run_recursively(), the @unserialize() call instantiates the attacker's object; on tear-down, RaiiPattern::__destruct() invokes call_user_func() with attacker-supplied arguments, yielding arbitrary PHP execution under the web server account. … |
| Remediation | Upgrade the Blocksy theme to version 2.1.41 or later, where the fixed code paths (db-search-replacer.php, meta-boxes.php, validator.php, and raii.php) are visible at https://themes.trac.wordpress.org/browser/blocksy/2.1.41/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations running Blocksy theme and confirm version numbers; catalog sites running version 2.1.35 or lower. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today