EUVD-2026-89911
GHSA-gj2r-qc55-w46r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Blocksy Companion ≤2.1.55
-
DeliverySend crafted request to unprotected endpoint
-
ExploitMissing authorization check bypassed
-
ExecutionRead or alter limited data
-
ImpactLow-impact information disclosure/tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against default configurations of any site running Blocksy Companion ≤2.1.55 - no authentication, no user interaction, and no special configuration are required (PR:N/UI:N/AC:L). The only prerequisite is that the vulnerable plugin is installed and network-reachable. Impact is inherently LIMITED by the vulnerability itself: only Low confidentiality and Low integrity effects (C:L/I:L, A:N), meaning an attacker can access or modify a restricted subset of data/functionality rather than achieve full site takeover. The specific feature/endpoint governing exploitation is not disclosed in available data. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 Medium) describes a network-reachable, low-complexity flaw requiring no authentication and no user interaction, which normally elevates urgency. However, the impact is bounded to Low confidentiality and Low integrity with no availability effect, consistent with CWE-862 Missing Authorization exposing or allowing modification of a limited subset of data/functionality rather than full compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. Net: a genuinely unauthenticated flaw in a widely-used WordPress plugin deserves prompt patching, but the capped C:L/I:L impact and absence of exploitation signals place it as a moderate - not top - priority. The description is sparse: it names neither the affected endpoint/parameter nor the specific data/action exposed, so the precise blast radius cannot be confirmed from available data. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a Blocksy Companion endpoint (likely an AJAX or REST action) that fails to verify the caller's authorization, allowing them to read limited plugin/site data or trigger a low-impact state change. No credentials, user interaction, or special client are needed. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated attackers can exploit a broken access control flaw in the Blocksy Companion WordPress plugin versions up to and including 2.1.55, allowing them to bypass authorization and access or modify limited site data. The vulnerability is remotely exploitable without authentication or user interaction (CVSS 6.5), and it affects any default WordPress installation with the vulnerable plugin. No public exploit code has been identified at the time of analysis, and the impact is constrained to low confidentiality and integrity effects.
RemediationAI
No vendor-released patch version is specified in the provided data. The primary remediation is to update the Blocksy Companion plugin to the latest version available, as the vulnerability affects versions up to and including 2.1.55; a fixed version likely exists beyond 2.1.55 and should be applied as soon as it is released. Check the Patchstack advisory for updates. If updating is not immediately possible, consider temporarily disabling the Blocksy Companion plugin, accepting that it may break Blocksy theme functionality. Alternatively, deploy a Web Application Firewall (WAF) with virtual patching rules to block exploitation attempts, though the effectiveness depends on the specific vulnerable endpoint which is not publicly disclosed. Monitor the vendor's website and the Patchstack advisory for patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Blocksy Companion is a WordPress plugin developed by Creative Themes that extends the Blocksy theme's functionality. The vulnerability is classified as CWE-862 (Missing Authorization), meaning a specific function or endpoint lacks proper capability checks, allowing unauthenticated users to perform actions that should require higher privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates the flaw is network-accessible, low complexity, requires no authentication or user interaction, and results in limited confidentiality and integrity impact without affecting availability. The exact vulnerable endpoint or feature is not disclosed in the available data, but the CPE (cpe:2.3:a:creative_themes:blocksy_companion) confirms the affected software. No public exploit code is known.
Know when Blocksy Companion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network access with no user interaction (PR:N/AV:N/UI:N/AC:L); missing authorization yields limited data read and modification (C:L/I:L), no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Blocksy Companion
View allArbitrary file upload leading to remote code execution affects the premium Blocksy Companion Pro plugin for WordPress in
Remote code execution in the Blocksy Companion Pro WordPress plugin (all versions before 2.1.47) lets unauthenticated at
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) all
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are alrea
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authe
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up t
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widg
Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.0.28. Rated medium severity (CVSS 5.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.0.42. Rated medi
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (all versions through 2.1.45) enables authenticate
Exploit-DB