CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro Unauthenticated File Upload RCE Advanced Reviews → saveattachments → Custom Fonts strpos Bypass → shell.woff2.php Overview CVE-2026-58480 also tracked as CVE-2026-15158 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in Blocksy...

Exploit for CVE-2026-58480

CVE-2026-58480 / CVE-2026-15158 — Blocksy Companion Pro RCE...

Exploit for CVE-2026-58480

CVE-2026-58480 / CVE-2026-15158 — Blocksy Companion Pro RCE...

CVE-2026-58480

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

EUVD-2026-42233

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

CVE-2026-58480 Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

CVE-2026-58480

Blocksy Companion Pro ≤2.1.46 has an unauthenticated arbitrary file upload flaw: a flawed strpos() substring check in the Custom Fonts extension's save_attachments function allows double-extension filenames (e.g., shell.woff2.php) to bypass validation, enabling RCE. Multiple public PoCs exist. Up...

CVE-2026-58480

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

CVE-2026-58480 Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

CVE-2026-58480: Unrestricted Upload of File with Dangerous Type

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

PT-2026-56414

Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 Description An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The save attachments function fails to properly validate file extensions...

CVE-2026-57624

Unauthenticated Remote Code Execution RCE in Blocksy Companion Pro = 2.1.46 versions...

CVE-2026-57624

Unauthenticated Remote Code Execution RCE in Blocksy Companion Pro = 2.1.46 versions...

CVE-2026-57624 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in Blocksy Companion Pro = 2.1.46 versions...

EUVD-2026-41278

Unauthenticated Remote Code Execution RCE in Blocksy Companion Pro = 2.1.46 versions...

CVE-2026-57624

CVE-2026-57624 : Unauthenticated Remote Code Execution in WordPress Blocksy Companion Pro plugin (versions

CVE-2026-57624 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in Blocksy Companion Pro = 2.1.46 versions...

CVE-2026-57624: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Blocksy Companion Pro = 2.1.46 versions...

VulnCheck KEV: CVE-2026-58480

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Blocksy Companion Pro versions = 2.1.46...