Blocksy Companion Pro plugin for WordPress — CVE-2026-58480 (Critical)

Date Jul 8, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Blocksy · Companion Pro plugin for WordPress

CVE CVE-2026-58480

Critical vendor advisory CVE-2026-58480

Summary

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Blocksy Companion Pro plugin for WordPress. Patch or mitigate promptly.

Operator check

Review CVE-2026-58480 in your asset inventory. Apply patches per vendor guidance and verify Companion Pro plugin for WordPress is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-58480 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed