CVE-2026-58480 describes an unauthenticated arbitrary file upload vulnerability in the Blocksy Companion Pro WordPress plugin prior to version 2.1.47. The vulnerability arises from improper validation in the save_attachments function exposed via the Advanced Reviews feature. Specifically, the Custom Fonts extension uses a flawed strpos() substring check that can be bypassed by uploading files with double extensions (e.g., shell.woff2.php). This allows an attacker to upload executable PHP files that the server may run, resulting in remote code execution. The vulnerability has a critical CVSS 4.0 score of 9.2, indicating high impact and ease of exploitation without privileges or user interaction. No vendor advisory or patch information is currently available.

Successful exploitation allows unauthenticated attackers to upload and execute arbitrary PHP code on the affected server. This leads to remote code execution, potentially compromising the entire web server and underlying system. The vulnerability bypasses extension validation, making it easier for attackers to deploy malicious payloads without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload capabilities, disable the affected Advanced Reviews feature if possible, and monitor for suspicious file uploads. Avoid relying solely on substring checks for file validation.