Attack Chain

1. Reconnaissance and Target Identification: An unauthenticated attacker identifies a WordPress site running the Blocksy Companion Pro plugin (versions <= 2.1.46) with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions enabled.
2. Malicious Payload Crafting: The attacker crafts a PHP webshell or other executable script, naming it with a double extension such as evil.woff2.php or backdoor.ttf.php, to masquerade it as a legitimate font file.
3. Arbitrary File Upload: The attacker sends an unauthenticated HTTP POST request to the WordPress site's admin-ajax.php endpoint, targeting the plugin's save_attachments function. The request includes the crafted malicious file within the multipart/form-data body.
4. MIME Type Validation Bypass: The Blocksy Companion plugin's wp_check_filetype_and_ext filter, used by the Custom Fonts extension, processes the uploaded filename. Due to the use of strpos() for .woff2 or .ttf substring checks instead of proper extension validation, the malicious evil.woff2.php file bypasses the intended MIME type restrictions.
5. Malicious File Placement: The vulnerable save_attachments function proceeds to save the malicious evil.woff2.php file to a publicly accessible directory on the WordPress server.
6. Remote Code Execution: The attacker sends a subsequent HTTP GET request directly to the newly uploaded evil.woff2.php file. The web server executes the PHP script, allowing the attacker to run arbitrary commands on the server with the permissions of the web server process, achieving remote code execution.

Impact

Successful exploitation of CVE-2026-15158 allows unauthenticated attackers to achieve full remote code execution on affected WordPress installations. This can lead to complete compromise of the website and underlying server, including data theft, defacement, installation of backdoors, further network penetration, or integration into botnets. While no specific victim count is available, any WordPress site utilizing the premium Blocksy Companion Pro plugin with both WooCommerce Extra and Custom Fonts extensions active in versions up to 2.1.46 is at critical risk. The impact extends beyond the website itself, potentially affecting customer data, business operations, and organizational reputation.

Recommendation

• Patch CVE-2026-15158: Immediately update the Blocksy Companion Pro plugin to a patched version (2.1.47 or newer) as soon as it becomes available.
• Disable Vulnerable Extensions: If immediate patching is not possible, disable the "WooCommerce Extra (Advanced Reviews)" and "Custom Fonts" extensions within Blocksy Companion Pro to mitigate the vulnerability until an update can be applied.
• Implement Web Application Firewall (WAF) Rules: Configure your WAF to inspect multipart/form-data uploads and block files with double extensions (e.g., *.woff2.php, *.ttf.php) when uploaded to WordPress plugin endpoints like admin-ajax.php.