CVE-2026-58480: Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58480?
CVE-2026-58480 has a critical severity score of 9.8.
How do I fix CVE-2026-58480?
To fix CVE-2026-58480, update the Blocksy Companion Pro plugin to version 2.1.47 or later.
What type of vulnerability is CVE-2026-58480?
CVE-2026-58480 is classified as an unauthenticated arbitrary file upload vulnerability.
Which software is affected by CVE-2026-58480?
CVE-2026-58480 affects the Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47.
What impact does CVE-2026-58480 have on users?
CVE-2026-58480 allows attackers to upload malicious files, which can lead to remote code execution and compromise of the website.