CVE-2026-15158: Blocksy Companion Plugin RCE Vulnerability

CVE-2026-15158 Overview

CVE-2026-15158 is an unauthenticated arbitrary file upload vulnerability in the Blocksy Companion Pro plugin for WordPress. The flaw affects all versions up to and including 2.1.46 and resides in the save_attachments function. The Custom Fonts extension registers a wp_check_filetype_and_ext filter that uses strpos() to approve any filename containing .woff2 or .ttf as a substring, rather than validating the final extension with PATHINFO_EXTENSION. Attackers can upload files with double extensions such as shell.woff2.php, leading to remote code execution. Exploitation requires the premium blocksy-companion-pro plugin with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active [CWE-434].

Critical Impact
Unauthenticated attackers can upload executable PHP files to vulnerable WordPress sites, resulting in full remote code execution and site takeover.

Affected Products

Blocksy Companion Pro (blocksy-companion-pro) plugin for WordPress, all versions up to and including 2.1.46
Deployments with the Custom Fonts extension enabled
Deployments with the WooCommerce Extra (Advanced Reviews) extension enabled

Discovery Timeline

2026-07-09 - CVE-2026-15158 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15158

Vulnerability Analysis

The vulnerability originates in the Custom Fonts extension shipped with Blocksy Companion Pro. The extension hooks into WordPress's wp_check_filetype_and_ext filter to permit font uploads. Instead of extracting the true file extension, the filter checks whether the filename string contains .woff2 or .ttf anywhere using strpos(). This substring match approves filenames like shell.woff2.php, where the actual extension processed by the web server is .php.

The Advanced Reviews feature within the WooCommerce Extra extension exposes the save_attachments handler used to store uploaded files. Because this endpoint accepts uploads without authentication and relies on the flawed MIME validation supplied by Custom Fonts, an attacker can submit a POST request containing a crafted PHP payload disguised with a font-related substring. Once the file lands under the WordPress uploads directory, requesting it directly triggers PHP execution.

Root Cause

The root cause is improper extension validation. The plugin uses strpos($filename, '.woff2') and strpos($filename, '.ttf') rather than pathinfo($filename, PATHINFO_EXTENSION). Substring matching cannot distinguish the trailing extension from embedded text, so any polyglot filename with a font substring bypasses the file type check.

Attack Vector

Remote, unauthenticated attackers reach the vulnerable endpoint over HTTP. No user interaction or privileges are required. The attacker submits a multipart form upload with a filename such as payload.woff2.php to the Advanced Reviews attachment handler. The server stores the file with the original extension, and a follow-up HTTP request to the uploaded path executes the embedded PHP code.

Refer to the WordPress Plugin Custom Fonts Code and the WordPress Plugin Advanced Reviews Code for the affected source lines.

Detection Methods for CVE-2026-15158

Indicators of Compromise

Files in wp-content/uploads/ with double extensions such as .woff2.php, .ttf.php, .woff2.phtml, or .ttf.phar
Unexpected PHP files stored inside font or attachment directories associated with the Advanced Reviews feature
New administrator accounts, modified wp-config.php, or webshell artifacts appearing shortly after suspicious multipart POST requests

Detection Strategies

Inspect web server access logs for POST requests targeting the Advanced Reviews save_attachments handler from unauthenticated sessions
Alert on any HTTP GET request that resolves to a file under wp-content/uploads/ ending in .php, .phtml, or .phar
Deploy behavioral endpoint monitoring, such as Singularity Endpoint, to identify PHP-FPM or Apache child processes spawning shells, curl, wget, or python immediately after upload activity

Monitoring Recommendations

Forward WordPress, PHP, and web server logs into a centralized analytics platform such as Singularity Data Lake for correlation with process telemetry
Enable file integrity monitoring across wp-content/uploads/ and plugin directories to flag newly created executable files
Track outbound connections from the web tier to detect command-and-control activity following successful exploitation

How to Mitigate CVE-2026-15158

Immediate Actions Required

Update Blocksy Companion Pro to a version later than 2.1.46 once the vendor releases a fix
Disable the Custom Fonts extension or the WooCommerce Extra (Advanced Reviews) extension until the plugin is patched
Audit wp-content/uploads/ for files with double extensions and remove any unauthorized artifacts
Rotate WordPress administrator credentials, API keys, and database secrets if compromise is suspected

Patch Information

At publication, the vendor has not released a patched version beyond 2.1.46. Monitor the Wordfence Vulnerability Report and the plugin repository for updates and apply them as soon as they become available.

Workarounds

Deactivate the blocksy-companion-pro plugin entirely if either vulnerable extension cannot be disabled
Configure the web server to deny PHP execution inside wp-content/uploads/ using directory-level rules
Deploy a Web Application Firewall rule that blocks uploads with filenames containing more than one extension or with .php following .woff2 or .ttf

bash

# Apache: block PHP execution inside uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}