Loading story…
A critical vulnerability tracked as CVE-2026-58480 affects the Blocksy Companion Pro WordPress plugin before version 2.1.47, allowing unauthenticated attackers to achieve remote code execution through arbitrary file upload. The flaw is exposed via the Advanced Reviews feature's save_attachments function and stems from a flawed strpos() substring validation in the Custom Fonts extension. By submitting a double-extension payload such as shell.woff2.php, an attacker can bypass extension checks and upload a file that the server may execute as PHP.
The issue has been rated CVSS 9.8 under v3.1 and 9.2 under v4.0, with reporting indicating active scanning for vulnerable sites. Successful exploitation could lead to full compromise of the WordPress instance and potentially the underlying server. The vendor has addressed the flaw in version 2.1.47, and organizations running Blocksy Companion Pro are advised to upgrade immediately and, if patching is delayed, disable the Advanced Reviews feature and verify that file upload restrictions are properly enforced.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A later report stated that active scanning for vulnerable Blocksy Companion Pro installations had been observed following disclosure of CVE-2026-58480. The same report noted that no public proof-of-concept was available at the time of publication.
Multiple advisories disclosed CVE-2026-58480, a critical unauthenticated arbitrary file upload vulnerability in Blocksy Companion Pro before 2.1.47. The flaw is in the save_attachments path exposed through Advanced Reviews and can be exploited with a double-extension file such as shell.woff2.php to achieve remote code execution.
Blocksy Companion plugin version 2.1.47 was released, and references state that versions prior to 2.1.47 are affected while 2.1.47 fixes the unauthenticated file upload issue that can lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourcevulncheck.com
Open sourcewordpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Jun 29, 2026
A **critical vulnerability in the WordPress plugin *WPvivid Backup & Migration*** (aka *Migration, Backup, Staging – WPvivid Backup & Migration*) allows **unauthenticated arbitrary file upload leading to remote code execution (RCE)** on affected sites. Tracked as **CVE-2026-1357** with **CVSS 9.8**, the issue impacts plugin versions **<= 0.9.123** and is tied to the plugin’s remote transfer functionality (`send_to_site()` / `wpvivid_action=send_to_site`), which processes incoming backup data from other sites. Technical details indicate the exploit chain combines **broken cryptographic error handling** with **unsafe file write behavior**: when `openssl_private_decrypt()` fails, execution continues and a `false` value is passed into AES initialization, which is treated as a predictable **null-byte key**. Attackers can craft payloads encrypted with this null-byte key to bypass intended protections, then leverage missing file validation (and reported lack of filename/path sanitization enabling **directory traversal**) to write attacker-controlled files (e.g., PHP web shells) into web-accessible locations, enabling full site takeover and data access (including database contents).
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-0740**, a critical unauthenticated arbitrary file upload flaw in the **Ninja Forms File Uploads** premium add-on for WordPress that can lead to **remote code execution** and full site compromise. The vulnerability affects versions through `3.3.26` and stems from improper validation of file types and extensions in destination filenames, combined with missing filename sanitization that allows path traversal and placement of malicious PHP files in the webroot or other sensitive directories. Wordfence said it blocked more than **3,600** exploitation attempts in a 24-hour period and warned that attackers could use the bug to deploy web shells and take over vulnerable sites. Researcher **Sélim Lanouar** discovered the issue through Wordfence’s bug bounty program, and the vendor released a full fix in version `3.3.27` after an earlier partial remediation. Organizations using the add-on, which is deployed across more than **90,000** customer environments, have been urged to upgrade immediately.
Jun 29, 2026