{"cvss":9.2,"datePublished":"2026-07-02T00:00:00Z","dateUpdated":"2026-07-02T00:00:00Z","description":"Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.","dueDate":"","id":"CVE-2026-58480","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Blocksy Companion","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"creativethemes blocksy_companion Unrestricted Upload of File with Dangerous Type","vendor":"Creative Themes"}