CVE-2026-97247: WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Published Sep 30, 2026
·Updated
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
Affected Software
1 affected component
WordPress Blocksy Companion<=2.1.55
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Blocksy Companion Pluginto a version that resolves this vulnerability.Fixed in 2.1.56
Event History
Sep 30, 2026
CVE Published
via MITRE·12:28 PM
Data Sourced
via MITRE·12:28 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or prior authentication to exploit it.
2
What impact is indicated by the available severity data?
The supplied CVSS vector indicates network-reachable exploitation with low attack complexity and no user interaction. It indicates low confidentiality and integrity impact, with no availability impact.
3
Which plugin versions are affected?
Blocksy Companion versions 2.1.55 and earlier are identified as affected. The provided data does not identify a fixed version.