EUVD-2026-37605Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor WordPress account
-
DeliverySend crafted request to Blocksy Companion Pro endpoint
-
ExploitInject PHP into vulnerable code sink
-
ExecutionPlugin evaluates attacker input
-
PersistExecute code as web server user
-
ImpactPivot to full WordPress and host takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least the Contributor role on a site where Blocksy Companion Pro <= 2.1.37 is installed and active (PR:L in the CVSS vector). No user interaction is needed (UI:N) and the attack is reachable over the network via standard HTTP(S) to the WordPress admin or front-end endpoints exposed by the plugin. Exploitation is limited to sites that both run the Pro edition (not necessarily the free Blocksy Companion) and grant Contributor or higher accounts to potentially untrusted users - single-author or admin-only installations sharply reduce the attacker population. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows network-reachable, low-complexity exploitation requiring only low (Contributor) privileges, no user interaction, and a scope change with full CIA impact - a realistic worst case for any multi-author WordPress site. This is not in the CISA KEV catalog and no EPSS score was supplied, so widespread mass exploitation is not yet evidenced; however, Contributor accounts are commonly available on blogs, news sites, and membership platforms, which materially expands the realistic attacker pool. Note that the input does not include an EPSS probability or POC indicator, so the practical exploitation likelihood cannot be quantitatively compared against the high CVSS - sites that grant Contributor roles to untrusted users should treat this as a priority regardless. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privilege Contributor account on a WordPress site running Blocksy Companion Pro <= 2.1.37, then submits a crafted post, shortcode, or plugin action that injects PHP code into a vulnerable sink. The plugin evaluates the attacker-controlled input on the server, yielding code execution as the web server user and full takeover of the WordPress installation and any co-hosted data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Remote code execution in Blocksy Companion Pro (Creative Themes) versions 2.1.37 and earlier allows authenticated users with Contributor-level WordPress privileges to inject and execute arbitrary code on the underlying server. The flaw carries a CVSS 3.1 base score of 9.9 with scope change, reflecting that successful exploitation breaks out of the WordPress application context. No public exploit identified at time of analysis, but Patchstack has catalogued the issue in its WordPress vulnerability database.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data - administrators should upgrade Blocksy Companion Pro to the next release after 2.1.37 as published by Creative Themes and monitor https://patchstack.com/database/wordpress/plugin/blocksy-companion-pro/vulnerability/wordpress-blocksy-companion-pro-plugin-2-1-37-remote-code-execution-rce-vulnerability for the exact fixed version. Until patched, restrict who can hold the Contributor role (remove untrusted authors, disable open registration that defaults to Contributor), or temporarily deactivate Blocksy Companion Pro accepting the trade-off of losing its site-building features. A WordPress WAF such as Patchstack or Wordfence with a virtual patch for this CVE can also block exploitation, at the cost of an additional dependency and potential false positives on legitimate editor activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Blocksy Companion Pro is a premium WordPress plugin from Creative Themes that extends the Blocksy theme with site-building features such as custom post types, header/footer builders, and content blocks. The root cause is CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), which typically arises in WordPress plugins when user-supplied input is passed into shortcode handlers, template rendering helpers, or eval/include-style sinks without proper sanitization. The CPE cpe:2.3:a:creative_themes:blocksy_companion_pro:*:*:* indicates all versions through 2.1.37 are in scope across deployments.
Know when Blocksy Companion Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable WordPress endpoint (AV:N/AC:L), Contributor role required (PR:L), no interaction (UI:N), PHP code execution breaks WordPress app boundary into host (S:C) with full CIA impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.
Executive ViewAI
Blocksy Companion Pro, a widely-deployed WordPress plugin, contains a critical remote code execution vulnerability (CVE-2026-40783, CVSS 9.9) affecting versions 2.1.37 and earlier with no vendor patch currently available. Exploitation could allow attackers to execute arbitrary commands on affected servers and compromise all data hosted on those systems. Organizations using this plugin must implement urgent mitigations to prevent server takeover and data breach.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable plugin if business requirements allow; (2) Restrict or remove Contributor-level WordPress accounts to reduce attack surface; (3) Deploy Web Application Firewall (WAF) rules to detect exploitation attempts targeting this plugin; (4) Implement IP whitelisting for WordPress administrative access; (5) Enable comprehensive logging and monitoring of authentication events and server file modifications for incident detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Blocksy Companion Pro
View allUnauthenticated remote code execution affects Creative Themes' Blocksy Companion Pro WordPress plugin in all versions up
Unauthenticated SQL injection in Blocksy Companion Pro (a premium WordPress plugin from Creative Themes) prior to versio
GitHub PoC
Exploit-DB