Critical Remote Code Execution in Blocksy Companion WordPress Plugin (CVE‑2026‑58480)
What Happened — A remote code execution vulnerability (CVE‑2026‑58480) was disclosed for Blocksy Companion plugin version 2.1.46 and earlier. The flaw lets an unauthenticated attacker upload a malicious PHP file via the blc‑review‑images[] parameter, bypassing the extension check and executing arbitrary commands on the host. The vendor patched the issue in version 2.1.47.
Why It Matters for Compliance & Audit Readiness —
- Illustrates the necessity of continuous third‑party component monitoring, a core SOC 2 vendor‑management control.
- Shows why mapping each software component to a specific security control (and retaining remediation evidence) is essential for a defensible audit trail.
- Provides a concrete artifact—vulnerability scan result and patch ticket—that can be fed into Verisq’s Control Mapping capability for continuous compliance proof.
Who Is Affected — Any organization that runs WordPress sites with the Blocksy Companion plugin installed, including e‑commerce, media, professional services, and SaaS providers.
Recommended Actions —
- Upgrade immediately to Blocksy Companion 2.1.47 or later.
- Run a focused vulnerability scan on all WordPress plugins and record remediation tickets in your SOC 2 evidence repository.
- Integrate plugin version checks into your continuous vendor‑risk monitoring workflow. Source: https://www.exploit-db.com/exploits/52640
Technical Notes — The exploit uses an unauthenticated arbitrary file upload via the blc‑review‑images[] parameter, employing a double‑extension bypass (.woff2.php). CVSS 9.8 (Critical). Fixed in version 2.1.47. Source: https://www.exploit-db.com/exploits/52640