What is the CVSS score of EUVD-2026-41278?

EUVD-2026-41278 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Blocksy Companion Pro are affected by EUVD-2026-41278?

Blocksy Companion Pro WordPress plugin (all versions ≤2.1.46) contains a critical unauthenticated remote code execution vulnerability (CVSS 10.0) that allows attackers to fully compromise affected…

How to fix or mitigate EUVD-2026-41278?

24 hours: Audit all WordPress installations for Blocksy Companion Pro versions ≤2.1.46; implement interim protective controls (WAF rules blocking suspicious requests, network access restrictions, IP whitelisting). 7 days: Disable or uninstall the plugin from all affected systems; deploy alternative WordPress theme solution and validate application functionality. 30 days: Monitor Creative Themes security advisories for patch release (expected version 2.1.47 or later); deploy patch across all systems and verify remediation.

Blocksy Companion Pro EUVD-2026-41278

| CVE-2026-57624 CRITICAL

Code Injection (CWE-94)

2026-07-02 Patchstack

GHSA-f3xf-x8w4-hfx8

WordPress RCE Code Injection Wordpress Plugin Blocksy Companion Pro Creative Themes

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network code injection with no user interaction warrants AV:N/AC:L/PR:N/UI:N; RCE breaching the PHP/OS boundary beyond the plugin justifies S:C and full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:02 vuln.today

DescriptionCVE.org

Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

AnalysisAI

Unauthenticated remote code execution affects Creative Themes' Blocksy Companion Pro WordPress plugin in all versions up to and including 2.1.46, allowing remote attackers to inject and execute arbitrary code (CWE-94) without any authentication or user interaction. Rated CVSS 10.0 with a scope-changed vector, this is a maximum-severity flaw reported by Patchstack. No public exploit identified at time of analysis and it is not currently listed in CISA KEV, but the trivial exploitability of an unauthenticated RCE makes it a high-priority patching target.

Technical ContextAI

Blocksy Companion Pro is the premium add-on plugin for the widely-used Blocksy WordPress theme ecosystem, extending it with features such as custom post types, advanced widgets, and site-building utilities. The affected component is identified by CPE cpe:2.3:a:creative_themes:blocksy_companion_pro. The root cause is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), meaning attacker-controlled input reaches a code-evaluation or dynamic-execution sink within the plugin's PHP request handling, allowing an adversary to have server-side code interpreted and run. Because WordPress plugins execute in the context of the web application and underlying PHP runtime, successful code injection typically yields full application-level compromise.

RemediationAI

Upgrade Blocksy Companion Pro to a release newer than 2.1.46; the exact fixed version is not stated in the provided data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/blocksy-companion-pro/vulnerability/wordpress-blocksy-companion-pro-plugin-2-1-46-remote-code-execution-rce-vulnerability) and the Creative Themes vendor portal to confirm and apply the latest patched build. Until patched, reduce exposure by restricting access to the WordPress site with a Web Application Firewall (Patchstack offers virtual patching for this CVE) and by limiting reachability of the plugin's endpoints; if the Pro plugin is not essential, deactivating and removing it eliminates the attack surface at the cost of losing its features. Because the injection is unauthenticated, IP allowlisting of administrative paths alone is insufficient - front-end request filtering or the plugin's removal are the meaningful controls.