CVE-2026-58480 is a critical flaw (CVSS 9.8) in the Blocksy Companion Pro plugin for WordPress before 2.1.47. An unauthenticated file upload bypasses extension validation, which can lead to remote code execution. Update to 2.1.47 or later and inspect your uploads folder.
What's affected
- Blocksy Companion Pro for WordPress before 2.1.47.
- Patchstack lists the free Blocksy Companion plugin at 2.1.46 as affected.
- Fixed version: 2.1.47, per the record.
- The flaw sits in the save_attachments function exposed by the Advanced Reviews feature.
How to check if you're exposed
In the WordPress dashboard open Plugins and read the Blocksy Companion version. With WP-CLI run wp plugin list. Then look in wp-content/uploads for files with a double extension such as a font extension followed by .php, or any PHP file where only media should be.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Update the plugin to 2.1.47 or later.
- Search uploads for PHP files and double extension names.
- If you find one, treat the site as compromised: restore from a clean backup and rotate credentials.
- Block PHP execution inside the uploads directory at the web server.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
The record classes this as CWE-434 (Unrestricted Upload of File with Dangerous Type). A check on the file name used a substring test, so a name that contained an allowed extension anywhere passed, even when it ended with .php. A web server that executes PHP would then run the file.
Patchstack describes it as highly dangerous and expected to be mass exploited, and its page carries a known exploited label. The CVE is not in the CISA KEV list (the record flag is false), so this post does not claim confirmed exploitation. Act as if it could be.
The broader lesson is to validate the final extension and file content, and to stop uploads from executing.
Plugin upload flaws pay off for attackers because the result is a script they can run, and WordPress sites are plentiful. Even if your site was patched promptly, a short check of the uploads folder tells you whether anything arrived before the update.
The cause is a validation shortcut. Searching a file name for an allowed extension anywhere in the string is not the same as checking how the name ends. A name that contains one allowed extension followed by a second, executable one satisfies the first test and runs under the second. The remedy is to take the real final extension, compare it with a short allow list, and ideally rename the file on save.
If you manage many WordPress sites, an inventory of plugin names and versions across all of them turns an advisory like this into a five minute question instead of a day of logging in to dashboards.
Try it yourself
Plugin flaws like this one spread fast. This demo shows how a watch list surfaces a new advisory for something you already run.
Click through it at your own pace, or open it full screen.
Quick check
Does blocking PHP in uploads fix it?
It cuts off the code execution step, but you should still patch, since the upload itself is the flaw.
Which edition is covered?
The record names the Pro plugin before 2.1.47. Patchstack also lists the free plugin at 2.1.46, so update either one.
Sources
Last reviewed: 19 October 2026.
