CVE detail
CVE-2026-58480
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 5.2
Why it matters now
Mention timeline
- Total mentions
- 1
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
5 source links · newest first
- [webapps] Blocksy Companion 2.1.46 - RCEExploit-DB
Multiple Date: 2026-08-11 Vulnerable App: #!/usr/bin/env python3 # Exploit Title: Blocksy Companion 2.1.46 - RCE # CVE: CVE-2026-58480 # Date: 2026-07-13 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # V
exploitwww.exploit-db.comAug 11, 2026, 12:00 AM No excerpt available.
Patchwww.wordfence.comJul 8, 2026, 2:17 PM- https://www.vulncheck.com/advisories/blocksy-companion-pro-unauthenticated-file-upload-via-save-attachmentswww.vulncheck.com
No excerpt available.
Exploitwww.vulncheck.comJul 8, 2026, 2:17 PM - https://wordpress.org/plugins/blocksy-companion/wordpress.org
No excerpt available.
Release Noteswordpress.orgJul 8, 2026, 2:17 PM No excerpt available.
Exploitpatchstack.comJul 8, 2026, 2:17 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
1 repository references · best confidence 0.80 · max 3 stars
- shinthink/CVE-2026-58480Medium confidencegithubRepository topic discovery3 starsDiscovered Jul 26, 2026, 10:51 AM
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-73373CVSS 8.9 · High
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers th…
- CVE-2026-73996CVSS 9.8 · Critical
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
- CVE-2026-66627CVSS 9.9 · Critical
Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.
- CVE-2026-32474CVSS 9.9 · Critical
Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.
- CVE-2026-32463CVSS 9.9 · Critical
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.
- CVE-2026-28192CVSS 9.6 · Critical
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.