CVE-2026-15158 is an arbitrary file upload vulnerability in the Blocksy Companion WordPress plugin, specifically in the premium version with WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions enabled. The vulnerability arises from improper validation in the save_attachments function, where the Custom Fonts extension uses strpos() to check for .woff2 or .ttf substrings anywhere in filenames rather than validating the actual file extension. This allows attackers to upload files with double extensions like shell.woff2.php, which pass MIME validation and are treated as permitted font files, enabling potential remote code execution by unauthenticated users.

Successful exploitation allows unauthenticated attackers to upload arbitrary files that may be executable on the server, leading to full remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 9.8, indicating high exploitability and severe impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should disable the premium Blocksy Companion plugin or the affected extensions (WooCommerce Extra and Custom Fonts) to mitigate risk. Monitoring vendor channels for updates is strongly recommended.