Loading vulnerability…
CVE-2026-58480 is a critical unrestricted file upload vulnerability in the Blocksy Companion Pro plugin for WordPress affecting versions before 2.1.47. The flaw is exposed through the Advanced Reviews feature in the save_attachments function and is caused by improper file extension validation in the Custom Fonts extension. Specifically, the code uses a flawed strpos() substring check to determine whether an uploaded filename contains an allowed extension. An attacker can bypass this validation by supplying a double-extension filename such as shell.woff2.php: the presence of the allowed substring .woff2 causes validation to succeed, while the trailing .php extension can still be interpreted and executed by the web server. Because the vulnerable upload path is reachable without authentication, a remote attacker can upload a malicious PHP payload and then invoke it over HTTP to achieve remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small standalone Python exploit for CVE-2026-58480 / CVE-2026-15158 affecting Blocksy Companion Pro before 2.1.47 on WordPress. It contains two files: a README describing the vulnerability, prerequisites, and usage, and a single executable script, exploit.py, which performs fingerprinting, upload attempts, and shell discovery. The exploit targets an unauthenticated file upload in the Advanced Reviews functionality, relying on a weak Custom Fonts filename validation check that accepts filenames containing .woff2 or .ttf anywhere in the name. The script abuses this by generating or accepting a double-extension filename such as randomname.woff2.php and uploading a PHP webshell through the vulnerable AJAX handler using the multipart parameter blc-review-images[]. Primary capabilities implemented in exploit.py: - Fingerprints WordPress/Blocksy deployments by requesting /wp-content/themes/blocksy/style.css and /wp-content/plugins/blocksy-companion/readme.txt. - Parses detected version strings and flags versions below 2.1.47 as vulnerable. - Tries multiple possible AJAX action names associated with the save_attachments handler to improve reliability across deployments. - Uploads a hardcoded PHP command shell payload. - Searches likely upload directories under wp-content/uploads and related paths for the uploaded shell. - Supports single-target checking/exploitation and bulk target processing per the README examples. The payload is a basic PHP webshell that executes arbitrary system commands passed via the cmd request parameter using system(). This makes the exploit operational rather than a mere proof of concept. It is not part of a larger exploitation framework. Notable fingerprintable artifacts include the WordPress AJAX endpoint /wp-admin/admin-ajax.php, the upload parameter blc-review-images[], multiple candidate AJAX action names, and several likely shell locations under /wp-content/uploads/. The exploit assumes the target permits execution of uploaded PHP files from the uploads path; if PHP execution is disabled there, upload may succeed without yielding RCE.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unrestricted file upload vulnerability in the Blocksy Companion Pro WordPress plugin that allows unauthenticated remote code execution via a double-extension file upload bypass in the save_attachments function used by the Advanced Reviews feature.
An unauthenticated arbitrary file upload vulnerability in the Blocksy Companion Pro WordPress plugin before version 2.1.47 that can lead to remote code execution by bypassing extension validation using double-extension filenames.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.