Blocksy Companion Pro EUVD-2026-41278

No special conditions - remote unauthenticated exploitation is possible against network-reachable installations of Blocksy Companion Pro at version 2.1.46 or earlier, per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Unauthenticated RCE' description. The primary limiting factor is deployment scope: the target must be running the Pro (premium) plugin - not merely the free Blocksy Companion or the Blocksy theme - at an affected version, and the vulnerable endpoint must be reachable. The specific vulnerable feature, parameter, or configuration prerequisite is not detailed in the provided data and should be verified against the Patchstack advisory.

All available signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) indicates network-reachable, low-complexity exploitation with no privileges and no user interaction, plus a scope change reflecting impact beyond the vulnerable component. The CWE-94 code-injection class combined with the 'Unauthenticated RCE' description makes automated, reliable exploitation plausible. However, EPSS data was not provided, so exploitation probability could not be independently weighed, and the vulnerability is not listed in CISA KEV - there is no evidence of active exploitation. No public exploit code was referenced. In short: the theoretical risk is maximal and the barrier to exploitation is low, but real-world exploitation status is currently unconfirmed, so the priority rests on preventive patching rather than confirmed incident response.

A remote attacker sends a single crafted HTTP request to a public WordPress site running Blocksy Companion Pro 2.1.46 or earlier, injecting code into a vulnerable plugin parameter that the server evaluates as PHP. With no authentication or user interaction required, the attacker gains arbitrary code execution and can deploy a web shell, exfiltrate the database, or pivot into the hosting environment. No public proof-of-concept has been identified at time of analysis, but the low-complexity, unauthenticated nature makes reliable exploitation straightforward once the sink is known.