CVE-2026-57624: Blocksy Companion Pro RCE Vulnerability

CVE-2026-57624 Overview

CVE-2026-57624 is an unauthenticated Remote Code Execution (RCE) vulnerability affecting Blocksy Companion Pro versions <= 2.1.46. The flaw is classified under CWE-94 (Improper Control of Generation of Code) and carries a maximum CVSS score, reflecting network-based exploitation without authentication or user interaction. Attackers can execute arbitrary code on affected WordPress installations, leading to full site compromise. The vulnerability was published to the National Vulnerability Database (NVD) via Patchstack's WordPress vulnerability database.

Critical Impact
Unauthenticated attackers can execute arbitrary code on WordPress sites running Blocksy Companion Pro <= 2.1.46, resulting in complete server compromise.

Affected Products

Blocksy Companion Pro plugin for WordPress
All versions <= 2.1.46
WordPress sites using the affected plugin as a premium companion to the Blocksy theme

Discovery Timeline

2026-07-02 - CVE-2026-57624 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57624

Vulnerability Analysis

CVE-2026-57624 is a code injection vulnerability [CWE-94] in the Blocksy Companion Pro WordPress plugin. The flaw allows unauthenticated remote attackers to execute arbitrary code on the underlying web server. Because the attack requires no authentication and no user interaction, any exposed WordPress site running a vulnerable version is at risk of automated mass exploitation.

The scope-changed CVSS vector indicates that successful exploitation impacts resources beyond the plugin itself. An attacker who executes code in the web server context can pivot to the underlying operating system, exfiltrate WordPress database credentials, and establish persistent backdoors.

Root Cause

The root cause is improper control of code generation within the Blocksy Companion Pro plugin. According to the Patchstack advisory, the plugin fails to properly sanitize or validate input that is subsequently interpreted as executable code. This class of flaw typically arises when user-controlled data flows into functions such as eval(), include(), require(), create_function(), or call_user_func() without sufficient validation.

Attack Vector

The attack vector is network-based and reachable over standard HTTP or HTTPS. An unauthenticated attacker sends a crafted request to a vulnerable endpoint exposed by Blocksy Companion Pro. The plugin processes the attacker-controlled payload in a way that results in PHP code execution within the WordPress process. Refer to the Patchstack vulnerability record for technical specifics. No public proof-of-concept exploit code is currently documented in the enriched CVE data.

Detection Methods for CVE-2026-57624

Indicators of Compromise

Unexpected PHP files in wp-content/uploads/ or plugin directories, particularly with obfuscated content or web shell signatures
Outbound network connections from the web server to unfamiliar external hosts following HTTP requests to Blocksy Companion Pro endpoints
Unauthorized WordPress administrator accounts or modifications to wp-config.php, .htaccess, or theme files
Anomalous POST requests targeting AJAX or REST endpoints registered by blocksy-companion-pro

Detection Strategies

Inventory all WordPress installations and identify those running Blocksy Companion Pro at version <= 2.1.46
Review web server access logs for unusual POST requests to plugin endpoints, especially those containing serialized data, base64 strings, or PHP function names
Monitor for PHP processes spawning shell commands, such as sh, bash, curl, wget, or python, which are uncommon in normal WordPress operations
Use file integrity monitoring to detect creation or modification of PHP files within the WordPress installation

Monitoring Recommendations

Enable verbose logging on the web server and PHP-FPM to capture request bodies and error output
Forward WordPress, web server, and host telemetry to a centralized SIEM or data lake for correlation across HTTP, process, and file system events
Alert on any newly created scheduled tasks (wp_cron) or plugin installations occurring outside of change windows

How to Mitigate CVE-2026-57624

Immediate Actions Required

Identify all WordPress sites running Blocksy Companion Pro and upgrade the plugin to a version above 2.1.46 as soon as the vendor publishes a fix
If a patched version is not yet available, deactivate and remove Blocksy Companion Pro until remediation is confirmed
Rotate WordPress administrator credentials, database passwords, and any API keys stored in wp-config.php on sites that may have been exposed
Audit the WordPress installation for unauthorized users, unknown plugins, and modified core files

Patch Information

Refer to the Patchstack advisory for Blocksy Companion Pro for authoritative patch guidance and fixed version details. Apply the vendor-supplied update through the WordPress plugin update mechanism or by replacing the plugin directory with the fixed release.

Workarounds

Restrict access to WordPress admin and plugin endpoints using a Web Application Firewall (WAF) with virtual patching rules for CVE-2026-57624
Enforce IP allowlisting on /wp-admin/ and AJAX endpoints where feasible
Run PHP under a least-privilege user account and enable disable_functions in php.ini to restrict high-risk functions such as exec, system, passthru, and shell_exec
Deploy the plugin behind a reverse proxy that inspects and blocks requests containing suspicious PHP or command execution payloads

bash

# Example: disable the Blocksy Companion Pro plugin via WP-CLI
wp plugin deactivate blocksy-companion-pro
wp plugin delete blocksy-companion-pro

# Verify no residual plugin files remain
find /var/www/html/wp-content/plugins -maxdepth 1 -name 'blocksy-companion-pro*'