Share
## https://sploitus.com/exploit?id=0D8A3D47-A985-5A09-A40F-34F5859E7369
# CVE-2026-58480 / CVE-2026-15158 โ Blocksy Companion Pro RCE
**CVSS 9.8 (CRITICAL)** โ Unauthenticated Arbitrary File Upload to Remote Code Execution
## Overview
Blocksy Companion Pro = 2.1.47
2. Disable Custom Fonts and Advanced Reviews extensions until patched
3. Delete suspicious files in `wp-content/uploads/` with double extensions
4. Block PHP execution in uploads directory via `.htaccess` or server config
## Timeline
| Date | Event |
|---|---|
| 2026-06-17 | Vulnerable version (2.1.46) released |
| 2026-06-24 | Patch released (2.1.47) |
| 2026-07-08 | CVE-2026-58480 published |
| 2026-07-09 | CVE-2026-15158 published |
## References
- [NVD CVE-2026-58480](https://nvd.nist.gov/vuln/detail/CVE-2026-58480)
- [OpenCVE CVE-2026-15158](https://app.opencve.io/cve/CVE-2026-15158)
- [FreshySites Technical Analysis](https://freshysites.com/security-bulletins/blocksy-companion-plugin-vulnerability-cve-2026-15158/)
- [Wordfence Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/blocksy-companion/blocksy-companion-2146)
- [SecurityPointBreak](https://securitypointbreak.com/2026/07/08/critical-blocksy-wordpress-plugin-bug-lets-attackers-skip-login-entirely/)
- [VulnCheck Advisory](https://www.vulncheck.com/advisories/blocksy-companion-pro-unauthenticated-file-upload-via-save-attachments)
- [WordPress Plugin](https://wordpress.org/plugins/blocksy-companion/)
- [WordPress Trac โ Custom Fonts](https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.46/framework/premium/extensions/custom-fonts/extension.php#L137)
- [WordPress Trac โ Advanced Reviews](https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.46/framework/premium/extensions/woocommerce-extra/features/advanced-reviews/feature.php#L811)
## Disclaimer
This exploit is provided for educational and authorized security research only.
Do not use against systems without explicit permission from the owner.