Product

Blocksy Companion Pro (< 2.1.47)

1 brief RSS

Critical RCE Vulnerability in Blocksy Companion Pro WordPress Plugin (CVE-2026-58480)

An unauthenticated arbitrary file upload vulnerability (CVE-2026-58480) in Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 allows attackers to bypass extension validation via double-extension files, leading to remote code execution by forcing the web server to execute uploaded PHP files.

PoC Blocksy Companion Pro plugin < 2.1.47 +2 wordpress plugin rce file-upload web

1r 3t 2c 1i updated 2w ago