CVE-2026-39596: Blocksy Companion Pro SQLi Vulnerability

CVE-2026-39596 Overview

CVE-2026-39596 is an unauthenticated SQL Injection vulnerability affecting the Blocksy Companion Pro WordPress plugin in versions prior to 2.1.29. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Remote attackers can inject SQL statements without authentication, making the vulnerability exploitable over the network with low complexity. Successful exploitation can expose database contents and degrade availability of the affected WordPress site.

Critical Impact
Unauthenticated attackers can issue arbitrary SQL queries against the WordPress database, leading to data disclosure and potential service disruption.

Affected Products

Blocksy Companion Pro plugin for WordPress
All versions prior to 2.1.29
WordPress sites running the vulnerable Blocksy Companion Pro plugin

Discovery Timeline

2026-06-17 - CVE-2026-39596 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39596

Vulnerability Analysis

The vulnerability is an unauthenticated SQL Injection in Blocksy Companion Pro versions earlier than 2.1.29. Attackers reach the vulnerable code path remotely without credentials or user interaction. The injection occurs because user-supplied input is concatenated into a SQL statement without proper parameterization or escaping. As a result, attackers can manipulate query logic executed by the WordPress database. The EPSS probability is 0.372% (percentile 28.88) as of 2026-06-18, indicating limited observed exploitation activity at publication.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command, mapped to CWE-89. The plugin processes attacker-controlled parameters and passes them into a database query without using prepared statements or the WordPress $wpdb->prepare() API. This allows injected SQL fragments to alter query structure.

Attack Vector

The attack vector is network-based. An unauthenticated remote attacker sends crafted HTTP requests to a vulnerable endpoint exposed by Blocksy Companion Pro. Because no privileges or user interaction are required, mass scanning and automated exploitation against exposed WordPress sites are feasible.

No verified public proof-of-concept code is available at the time of writing. For technical details, refer to the Patchstack SQL Injection Vulnerability advisory.

Detection Methods for CVE-2026-39596

Indicators of Compromise

HTTP requests to Blocksy Companion Pro endpoints containing SQL meta-characters such as ', ", --, UNION SELECT, or SLEEP(
Unexpected database errors or long-running queries originating from WordPress PHP workers
Anomalous outbound data transfer from the WordPress host following inbound requests to plugin endpoints
Requests from a single source iterating across parameter values within a short window

Detection Strategies

Inspect web server access logs for plugin URLs combined with encoded SQL syntax (%27, %22, %20OR%20, %20UNION%20)
Deploy a Web Application Firewall (WAF) rule set with SQL injection signatures applied to WordPress traffic
Correlate WordPress debug.log SQL errors with the source IP that issued the corresponding HTTP request

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for SQL injection pattern matching
Alert on spikes in 500-series responses or database error rates from the WordPress host
Monitor for newly created WordPress administrator accounts or modifications to the wp_users and wp_options tables

How to Mitigate CVE-2026-39596

Immediate Actions Required

Update Blocksy Companion Pro to version 2.1.29 or later on every affected WordPress installation
Audit the WordPress database for unauthorized changes, new privileged users, and injected content
Rotate WordPress secret keys in wp-config.php and force a password reset for administrative accounts
Block external access to the WordPress site from untrusted networks until the patch is applied

Patch Information

The vendor addressed the issue in Blocksy Companion Pro version 2.1.29. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the fixed release. See the Patchstack advisory for vendor coordination details.

Workarounds

Enable a WAF with SQL injection protections in front of the WordPress site
Restrict access to plugin endpoints by IP allow-list at the reverse proxy or web server layer
Apply virtual patching rules from a managed WordPress security service until the official update is deployed
Temporarily deactivate Blocksy Companion Pro if the patched version cannot be installed immediately

bash

# Update Blocksy Companion Pro using WP-CLI
wp plugin update blocksy-companion-pro --version=2.1.29
wp plugin list --name=blocksy-companion-pro --fields=name,status,version