Attack Chain

1. An unauthenticated attacker identifies a WordPress site running the Blocksy Companion Pro plugin version prior to 2.1.47.
2. The attacker crafts a malicious file, such as shell.woff2.php, containing PHP code.
3. The attacker sends an HTTP POST request to the save_attachments function, which is exposed via the Advanced Reviews feature, attempting to upload the malicious file. This likely targets the admin-ajax.php endpoint.
4. The plugin's validation process, specifically the strpos() check in the Custom Fonts extension, mistakenly passes the filename shell.woff2.php because it contains the .woff2 substring.
5. The save_attachments function proceeds with the upload, placing the file on the web server.
6. The web server, recognizing the .php extension, attempts to execute the uploaded file as a PHP script when accessed, leading to remote code execution.
7. The attacker gains arbitrary code execution, typically establishing a web shell for persistent access and further compromise.

Impact

The successful exploitation of CVE-2026-58480 leads to full remote code execution on the compromised WordPress server. This allows attackers to deface websites, inject malicious content, exfiltrate sensitive data (e.g., customer information, intellectual property), establish persistent access via web shells, and potentially pivot to other systems within the network. For businesses relying on WordPress for e-commerce, content delivery, or lead generation, this can result in significant financial losses, reputational damage, and regulatory penalties. The high CVSS score of 9.8 reflects the critical nature of this unauthenticated RCE.

Recommendation

• Immediately update the Blocksy Companion Pro plugin to version 2.1.47 or later to patch CVE-2026-58480.
• Deploy the Sigma rule "Detects CVE-2026-58480 Exploitation - Blocksy Companion Pro File Upload Bypass" to your SIEM to detect attempts to exploit this vulnerability.
• Enable detailed webserver logging (e.g., Apache access logs, Nginx access logs) to capture full HTTP request details, including URI stems, query strings, and request methods, which are crucial for the detection rule.
• Regularly review web server access logs for suspicious file uploads to /wp-content/uploads/ or other writable directories, especially for files with double extensions.

Attack Chain

1. An unauthenticated attacker crafts an HTTP POST request targeting a WordPress endpoint handled by the VikBooking plugin (e.g., a booking form submission or a profile update function accessible to unauthenticated users).
2. The attacker embeds a malicious JavaScript payload within the 'email' parameter of this POST request, for instance, <script>alert('XSS');</script>.
3. Due to inadequate input validation, the VikBooking plugin processes and stores this unsanitized 'email' parameter, including the embedded script, into the WordPress database.
4. The malicious script becomes persistently stored on the server as part of the plugin's data, associated with a booking or user entry.
5. A legitimate user or administrator subsequently navigates to a WordPress page (e.g., a booking details page, an admin panel view) that retrieves and displays the compromised 'email' parameter from the database.
6. When the affected page loads in the victim's browser, the stored malicious JavaScript payload is executed within the context of the victim's session.
7. This client-side execution can lead to session hijacking (e.g., cookie theft), redirection to malicious sites, defacement of the webpage, or the download and execution of further malware.
8. The attacker achieves their objective, potentially gaining unauthorized access to sensitive information or control over the victim's session.

Impact

The successful exploitation of CVE-2026-6820 can lead to severe consequences for organizations utilizing the VikBooking Hotel Booking Engine & PMS plugin. Attackers can hijack administrator sessions, leading to full compromise of the WordPress site, including data exfiltration, website defacement, or malware distribution to visitors. For regular users, session hijacking could expose personal booking details or lead to credential theft via phishing. Given the plugin's function, hospitality businesses and any entity managing bookings online are particularly vulnerable. While no specific victim count is available, the widespread use of WordPress and its plugins suggests a significant potential attack surface, impacting reputation, data privacy, and operational continuity.

Recommendation

1. Immediately update the VikBooking Hotel Booking Engine & PMS plugin to version 1.8.9 or higher to patch CVE-2026-6820.
2. Deploy or update Web Application Firewall (WAF) rules to detect and block common Stored XSS payloads, specifically targeting inputs to WordPress endpoints that handle the 'email' parameter as described for CVE-2026-6820.
3. Review web server access logs (e.g., Apache, Nginx) for HTTP POST requests to WordPress paths containing the 'email' parameter with suspicious characters, such as <script>, onerror=, or javascript:, which could indicate exploitation attempts of CVE-2026-6820.
4. Conduct security audits of all WordPress installations and plugins to identify and remediate similar input sanitization and output escaping vulnerabilities.