Blocksy Companion 插件超危漏洞预警

漏洞速览

• 风险评分：9.8（严重）
• 首次披露：2026-07-01
• 最近更新：2026-07-01
• 软件类型：插件
• 软件标识：blocksy-companion
• 受影响版本：<= 2.1.46
• 修复版本：2.1.47
• 是否已修复：是

漏洞详情

The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the saveattachments function. This is due to the Custom Fonts extension registering a wpcheckfiletypeandext filter that approves any filename containing .woff2 or .ttf as a substring via strpos() rather than validating that those strings appear as the final extension via PATHINFOEXTENSION — allowing double-extension filenames such as shell.woff2.php to pass MIME validation and be handled as permitted font files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable when the premium version of the plugin (blocksy-companion-pro) is installed with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active; the free blocksy-companion plugin does not contain the vulnerable code paths.

影响与风险

• 漏洞类型：Unauthenticated Arbitrary File Upload via ‘blc-review-images[]’ Parameter
• 风险说明：漏洞可能被利用以执行未授权操作，建议按官方修复方案立即升级并复核安全配置。
• 研究人员：Nguyen Ba Khanh

修复建议

1. 按官方建议执行修复：更新至 2.1.47 或更高已修复版本。
2. 复核 administrator/shop manager 等高权限账号与角色授权。
3. 排查近期插件安装/配置变更记录，确认无异常写入。
4. 建议配合 WAF 与登录审计，持续观察可疑请求。

延伸阅读

• Wordfence 原始漏洞记录
• WordPress 插件页面
• CVSS 3.1 评分说明
• CVE 官方记录
• CVE 官方记录
• CVE 官方记录