Blocksy Companion Unauthenticated Arbitrary File Upload via Custom Fonts Filter (RCE)

Vulnerability Overview Vulnerability Name: Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter CVSS Score: 9.8 (Critical) Publish Date: July 1, 2026 Last Updated: July 1, 2026 Researcher: Nguyen Ba Kharsh Impact Scope Software Type: Plugin Software Identifier: blocksy-companion (view on wordpress.org) Affected Versions: <= 2.1.46 Fixed Version: 2.1.47 Remediation Fix Status: Fixed Recommendation: Update to version 2.1.47 or later fixed version Vulnerability Description A vulnerability allowing arbitrary file uploads exists in the Blocksy Companion plugin for WordPress in versions <= 2.1.46. This vulnerability arises because the Custom Fonts extension registers a filter that approves any filename containing or as a substring, rather than validating that these strings appear as the final extension via . This allows filenames such as to bypass MIME validation and be treated as allowed text files. This enables unauthenticated attackers to upload executable files, potentially leading to Remote Code Execution (RCE). This vulnerability is only exploitable when the paid version of Blocksy Companion Pro is installed, and the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions are active. The free Blocksy Companion plugin does not contain the vulnerable code path. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org Recent Vulnerabilities Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter - CVE ID: CVE-2026-12430 - CVSS: 4.4 - Researcher: Pasindu Dileshan (K4PXD) - Date: June 18, 2026 Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass - CVE ID: CVE-2025-12846 - CVSS: 8.8 - Researcher: shark3y - Date: November 10, 2025 Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-12475 - CVSS: 6.4 - Researcher: Rafahanzani Suhada - Date: October 6, 2025 Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode - CVE ID: CVE-2025-05665 - CVSS: 6.4 - Researcher: Muhammad Yudha - DJ - Date: September 16, 2025 Blocksy Companion <= 2.0.42 - Authenticated (Admin+) Server-Side Request Forgery - CVE ID: CVE-2024-35633 - CVSS: 5.5 - Researcher: Yuchen Ji - Date: May 30, 2024 Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads - CVE ID: CVE-2024-4487 - CVSS: 6.4 - Researcher: wesley (wcraft) - Date: May 10, 2024 Blocksy Companion <= 2.0.28 - Cross-Site Request Forgery - CVE ID: CVE-2024-31922 - CVSS: 5.3 - Researcher: R3ND - Date: April 10, 2024 Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-2392 - CVSS: 6.4 - Researcher: Ngô Thiên An (ancom_) - Date: March 21, 2024 Blocksy Companion <= 1.8.81 - Authenticated(Subscriber+) Sensitive Information Exposure via blocksy_posts shortcode - CVE ID: CVE-2023-1911 - CVSS: 4.3 - Researcher: Erwan LR - Date: April 10, 2023 Blocksy Companion <= 1.8.67 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2023-23898 - CVSS: 6.4 - Researcher: Rafahanzani Suhada - Date: January 27, 2023 Additional Information Disclaimer: This record contains copyrighted material. License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-fee, irrevocable, non-transferable copyright license to copy, prepare derivative works of, publicly display, publicly perform, adapt, and distribute this software vulnerability information. The grant is subject to the condition that you include a hyperlink to this vulnerability information and retain Defiant's copyright notice and any copies of this license. Contact: For any questions or errors, please contact info@support@wordfence.com. Business Hours Support Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Products Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscri

Goal Reached Thanks to every supporter — we hit 100%!

Blocksy Companion Unauthenticated Arbitrary File Upload via Custom Fonts Filter (RCE)

More from this source