What is the CVSS score of CVE-2026-8365?

CVE-2026-8365 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Blocksy theme are affected by CVE-2026-8365?

Blocksy WordPress theme versions 2.1.35 and below allow contributor-level users to gain remote code execution; no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-8365?

Within 24 hours: Identify all WordPress installations running Blocksy theme and confirm version numbers; catalog sites running version 2.1.35 or lower. Within 7 days: Restrict contributor-level user accounts to critical personnel only; enforce multi-factor authentication for contributors; consider deactivating Blocksy theme if no patch is available from vendor. Within 30 days: Monitor Blocksy security advisories for patch release; deploy patch to all affected sites immediately upon availability; if patch is not released, migrate to alternative WordPress theme.

Blocksy theme CVE-2026-8365

EUVD-2026-35379 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-09 Wordfence

GHSA-r622-c48h-h6qq

PHP Deserialization WordPress RCE Blocksy

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 09:15 vuln.today

CVE Published

Jun 09, 2026 - 08:29 nvd

HIGH 8.8

DescriptionCVE.org

The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '<' or '>' and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().

Articles & Coverage 2

News 4 New WordPress Vulnerabilities - 4 High Severity Jun 10, 2026 News 4 New WordPress Vulnerabilities - 4 High Severity Jun 09, 2026

AnalysisAI

Authenticated PHP Object Injection in the Blocksy WordPress theme (versions ≤ 2.1.35) allows contributor-level users to escalate to remote code execution by storing a malicious serialized object in post meta that is later deserialized during the V200 database migration. Wordfence-reported flaw chains weak input sanitization in blocksy_sanitize_post_meta_options() with an unconditional @unserialize() call in SearchReplacer::run_recursively(), triggering RaiiPattern::__destruct() to invoke arbitrary callables via call_user_func(). No public exploit identified at time of analysis, but the low-privilege requirement and high impact make this a meaningful priority for sites running upgraded Blocksy installations.

Technical ContextAI

Blocksy is a popular WordPress theme by CreativeThemesHQ (CPE cpe:2.3:a:creativethemeshq:blocksy). The root cause is CWE-502 (Deserialization of Untrusted Data). Two code paths combine to create the vulnerability: blocksy_sanitize_post_meta_options() in admin/helpers/meta-boxes.php performs only superficial sanitization that rejects values containing '<' or '>' but permits PHP serialized object strings (which use characters like 'O:', ':', '{', '}', '"') to be persisted into the 'blocksy_meta' REST API field. Separately, the database migration utility SearchReplacer::run_recursively() in inc/classes/db-versioning/utils/db-search-replacer.php calls @unserialize() on stored string values without an allowed_classes restriction, instantiating attacker-controlled objects. The Blocksy\RaiiPattern class (inc/classes/raii.php) defines a __destruct() magic method that invokes call_user_func() on an instance-controlled callable, providing a classic POP gadget for arbitrary PHP execution within the WordPress process context.

RemediationAI

Upgrade the Blocksy theme to version 2.1.41 or later, where the fixed code paths (db-search-replacer.php, meta-boxes.php, validator.php, and raii.php) are visible at https://themes.trac.wordpress.org/browser/blocksy/2.1.41/. Until the upgrade can be applied, restrict who can author content by auditing all accounts at contributor level and above, disabling new-user self-registration (Settings → General → 'Anyone can register'), and enforcing strong passwords / MFA for editorial accounts - this directly raises the bar for the PR:L precondition, with the trade-off of inconveniencing legitimate contributors. As a stop-gap, defer running the V200 database migration on upgraded sites until the patched theme version is in place, since the deserialization sink only fires during migration; note this means delaying the upgrade itself, which leaves the storage-side sanitization weakness in place. Monitor wp_postmeta for suspicious 'blocksy_meta' values containing serialized object signatures (e.g. 'O:' followed by class names) as a detection control.