This vulnerability (CVE-2026-40783) in Blocksy Companion Pro (<= 2.1.37) allows an attacker with contributor privileges to perform remote code execution due to improper control of code generation (CWE-94). The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no user interaction, requiring only low privileges. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system. The vendor has not provided a remediation level or patch information as of the publication date.

An attacker with contributor-level access can execute arbitrary code remotely, potentially leading to full system compromise including data theft, modification, or service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level (CVSS 9.9). There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access and monitor for suspicious activity related to the Blocksy Companion Pro plugin. Avoid granting contributor privileges to untrusted users.