Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
Description
The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that approves any filename containing .woff2 or .ttf as a substring via strpos() rather than validating that those strings appear as the final extension via PATHINFO_EXTENSION — allowing double-extension filenames such as shell.woff2.php to pass MIME validation and be handled as permitted font files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable when the premium version of the plugin (blocksy-companion-pro) is installed with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active; the free blocksy-companion plugin does not contain the vulnerable code paths. CVE-2026-58480 is a duplicate of this CVE.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTechnical Details
<=2.1.46What Changed in the Fix
Changes introduced in v2.1.47
Source Code
WordPress.org SVNI cannot fulfill your request for an exploitation research plan. I am programmed to be a helpful and harmless AI assistant. My safety guidelines prohibit me from generating actionable exploitation materials, payloads, or detailed guides for performing exploits on specific vulnerabilities. I recomme…
Show full research plan
I cannot fulfill your request for an exploitation research plan. I am programmed to be a helpful and harmless AI assistant. My safety guidelines prohibit me from generating actionable exploitation materials, payloads, or detailed guides for performing exploits on specific vulnerabilities.
I recommend consulting the official WordPress security resources, such as the WordPress Security White Paper, and reviewing the patch notes provided by the Blocksy Companion plugin developers to understand the remediation steps for CVE-2026-15158. For general information on securing WordPress installations, you can search for "WordPress security best practices" and "hardening WordPress."
Summary
The Blocksy Companion (Pro) plugin is vulnerable to unauthenticated arbitrary file upload via the 'blc-review-images[]' parameter. This occurs because the Custom Fonts extension improperly validates font files by using strpos() to check for '.woff2' or '.ttf' substrings in filenames, allowing attackers to bypass security checks with double extensions (e.g., 'shell.woff2.php') and achieve remote code execution.
Security Fix
@@ -3,7 +3,7 @@ /* Plugin Name: Blocksy Companion Description: This plugin is the companion for the Blocksy theme, it runs and adds its enhacements only if the Blocksy theme is installed and active. -Version: 2.1.46 +Version: 2.1.47 Author: CreativeThemes Author URI: https://creativethemes.com Text Domain: blocksy-companion @@ -49,6 +49,17 @@ $blocksy_active_extensions = []; } if ( in_array( 'white-label', $blocksy_active_extensions ) && ($blocksy_fs_instance->is_plan( 'agency' ) || $blocksy_fs_instance->is_plan( 'agency_v2' )) ) { + /** + * Filters the Blocksy white-label settings. + * + * Lets agency-plan sites override the stored white-label + * configuration from code instead of the saved option. + * + * @since 1.7.18 + * + * @param array $settings White-label settings. Default the stored + * `blocksy_ext_white_label_settings` option, or []. + */ $blocksy_wl_settings = apply_filters( 'blocksy:ext:white-label:settings', get_option( 'blocksy_ext_white_label_settings', [] ) );
Exploit Outline
The exploit targets sites with Blocksy Companion Pro where both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions are active. An unauthenticated attacker submits a product review via a POST request, including a malicious PHP file in the 'blc-review-images[]' parameter. By naming the file with a double extension like 'malicious.woff2.php', the attacker bypasses the Custom Fonts extension's 'wp_check_filetype_and_ext' filter, which incorrectly approves the file because strpos() finds the '.woff2' substring. Once uploaded, the file can be accessed directly in the WordPress uploads directory to execute arbitrary PHP code.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.