CVE-2025-12846: Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12846?
CVE-2025-12846 is considered a high severity vulnerability due to the potential for authenticated arbitrary file uploads.
How do I fix CVE-2025-12846?
To fix CVE-2025-12846, update the Blocksy Companion plugin to version 2.1.20 or later, which addresses the file type validation issue.
Who is affected by CVE-2025-12846?
CVE-2025-12846 affects all versions of the Blocksy Companion plugin for WordPress up to and including version 2.1.19.
What causes CVE-2025-12846?
CVE-2025-12846 is caused by insufficient file type validation that fails to properly detect and sanitize SVG files and double extension files.
What kind of vulnerabilities can CVE-2025-12846 lead to?
CVE-2025-12846 can lead to unauthorized access and execution of malicious files on WordPress sites.