CVE-2026-57315: Blocksy Companion Pro Contributor RCE Vulnerability (2.1.45)

Technical summary

CVE-2026-57315 is classified as CWE-94 (Improper Control of Generation of Code—'Code Injection'), indicating that Blocksy Companion Pro fails to properly sanitize or validate user-supplied input before processing it in a code execution context. The vulnerability requires authenticated access at the contributor level or higher, meaning an attacker must either be a legitimate but malicious contributor or compromise such an account. The broad CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.5 HIGH) reflects network-based exploitation with a high attack complexity, but once the contributor authentication barrier is cleared, the consequence is severe: confidentiality, integrity, and availability impacts across the system and potentially connected systems (scope change).

Business impact

A successful exploit allows an attacker to gain shell-level access to the WordPress hosting environment, enabling data exfiltration, malware installation, website defacement, and lateral movement to other applications or infrastructure. For agencies and enterprises running multi-site WordPress deployments, this can cascade across customer or departmental properties. Additionally, compromised sites may be leveraged for supply-chain attacks or used to host malicious content, damaging organizational reputation and triggering incident response, forensics, and potential regulatory notification obligations.

Affected systems

WordPress installations using Blocksy Companion Pro version 2.1.45 or earlier are affected. The vulnerability requires that a user with contributor-level permissions (or higher) exists on the site. This includes legitimate team members, freelancers, content creators, or accounts created via third-party integrations. Organizations should inventory all WordPress instances running Blocksy Companion Pro and confirm both the plugin version and the list of users with contributor or higher roles.

Exploitability

While authentication is required, the barrier is lower than admin-level access. Contributor accounts are commonly issued to content teams, external writers, and agency partners. Exploitation does not require user interaction, meaning an attacker with a compromised or rogue contributor account can trigger the vulnerability unilaterally. The attack complexity is marked as high, suggesting some environmental or technical prerequisites, but once those conditions align, execution is reliable and does not depend on social engineering or racing conditions.

Remediation

Immediately update Blocksy Companion Pro to a patched version above 2.1.45. Verify the update through your WordPress plugin dashboard and confirm the new version number post-deployment. In parallel, conduct a contributor-level access audit: review all users with contributor, editor, and admin roles; revoke unnecessary accounts; and rotate credentials for accounts that may have been compromised. Check site logs and file integrity for signs of unauthorized code execution during the vulnerability window.

Patch guidance

Obtain the latest patched version of Blocksy Companion Pro through the official WordPress plugin repository or the Blocksy vendor dashboard. Apply updates in a staging environment first to test for compatibility with your theme and other plugins. Most organizations can safely apply this patch without extended downtime. Verify the plugin version post-update by inspecting the plugin details in the WordPress admin panel or via direct file inspection (wp-content/plugins/blocksy-companion-pro/). If your organization has custom modifications to Blocksy Companion Pro, test thoroughly before production deployment.

Detection guidance

Monitor WordPress audit logs and web server logs for suspicious activity from contributor accounts, including file uploads, function calls, or POST requests to plugin files outside normal CMS workflows. Intrusion detection signatures may be available from vendors like Wordfence, Sucuri, or your WAF provider. Additionally, use WordPress security plugins to scan for unauthorized code modifications in the Blocksy Companion Pro directory. Check for unexpected PHP execution in wp-content/plugins/blocksy-companion-pro/ or temporary/cache directories. Forensic indicators include unusual processes spawned by the PHP process, outbound connections from the web server, and modification timestamps on plugin files.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, the scope of potential damage (confidentiality, integrity, and availability), and the relative ease of contributor account compromise compared to admin account compromise. While it does not yet appear on the KEV catalog, the combination of remote network attack surface, code execution capability, and the ubiquity of WordPress in web infrastructure justifies prioritization ahead of moderate-severity flaws. Organizations should treat this as a P1 security incident and apply patches within 24–48 hours.

Risk score, explained

The CVSS 3.1 score of 8.5 (HIGH) reflects: (1) network-based attack vector with no special network configuration required; (2) authentication requirement that lowers risk compared to unauthenticated RCE but remains exploitable via compromised or rogue contributor accounts; (3) high attack complexity, indicating some environmental prerequisites; (4) scope change, meaning the vulnerability impacts resources beyond the vulnerable component (e.g., other applications, the OS, adjacent systems); and (5) complete confidentiality, integrity, and availability impact once exploited. The lack of KEV designation does not reduce risk; it reflects lack of active in-the-wild exploitation at the time of publication, not absence of threat.

Frequently asked questions