Blocksy Companion Pro Unauthenticated Arbitrary File Upload RCE

Technical Analysis

CVE-2026-58480 stems from a flawed strpos() substring check in the save_attachments function used by the Custom Fonts extension, which validates file extensions by checking for a substring match rather than strictly verifying the file's true extension. Attackers can exploit this by uploading files with double extensions such as shell.woff2.php, which passes the substring validation (matching .woff2) while the underlying web server (typically Apache with mod_php or similar misconfiguration) executes the file as PHP due to the trailing .php extension. This results in unauthenticated remote code execution, granting attackers full control over the web server process, enabling data exfiltration, defacement, or use of the compromised host as a pivot point. If the compromised WordPress server hosts or is co-located with AI agent orchestration tools, RAG pipelines, or API credentials/secrets used by LLM-powered automation (e.g., webhook integrations, content-generation agents, or CMS-driven agent workflows), attackers gaining RCE could exfiltrate API keys, poison retrieval content, or hijack agent-triggered automation tasks, making this agent-relevant in shared-hosting or integrated CMS-agent deployments.

Affected Systems

Blocksy Companion Pro WordPress plugin versions prior to 2.1.47; WordPress installations with the Advanced Reviews feature and Custom Fonts extension enabled; servers running PHP interpreters that execute uploaded files based on extension pattern matching (e.g., Apache with permissive mod_php handler configuration).

Indicators of Compromise

• shell.woff2.php
• Advanced Reviews feature upload endpoint (save_attachments function)
• Suspicious POST requests to wp-admin/admin-ajax.php targeting Blocksy Companion Pro upload handlers
• Unexpected .php files in wp-content/uploads directories with double extensions

Remediation Steps

1. 1

   Update Blocksy Companion Pro

   Immediately update the Blocksy Companion Pro plugin to version 2.1.47 or later, which patches the flawed extension validation logic.

2. 2

   Audit uploads directory

   Scan wp-content/uploads and related media directories for suspicious files with double extensions (e.g., *.woff2.php, *.jpg.php) and remove any unauthorized PHP files or web shells.

3. 3

   Disable PHP execution in uploads directory

   Configure the web server (via .htaccess or server block) to prevent PHP execution within upload directories, mitigating similar file-upload vulnerabilities regardless of plugin-level validation flaws.

4. 4

   Implement Web Application Firewall (WAF) rules

   Deploy WAF rules to block file uploads with suspicious double-extension patterns and monitor for exploitation attempts targeting the Advanced Reviews or Custom Fonts endpoints.

5. 5

   Review server and application logs

   Check web server access and error logs for unauthorized POST requests to the plugin's upload endpoints and indicators of successful file uploads or command execution.

6. 6

   Rotate credentials and API keys

   If the affected server hosts integrated automation, CMS-driven agent workflows, or API keys used by AI tooling, rotate all potentially exposed credentials following a compromise assessment.