CVE-2026-8365: Blocksy WordPress Theme RCE Vulnerability

CVE-2026-8365 Overview

CVE-2026-8365 is a PHP Object Injection vulnerability in the Blocksy theme for WordPress affecting all versions up to and including 2.1.35. The flaw resides in the blocksy_meta REST API field and the V200 database migration routine. Authenticated attackers with contributor-level access or higher can inject a serialized Blocksy\RaiiPattern object into post meta. When the V200 migration runs on an upgraded site, the object is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func(). The vulnerability is classified under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Authenticated contributors can achieve Remote Code Execution on WordPress sites running vulnerable Blocksy versions once the V200 database migration triggers deserialization of attacker-controlled post meta.

Affected Products

Blocksy theme for WordPress versions up to and including 2.1.35
Blocksy theme for WordPress version 2.1.41 (per vendor source references)
Blocksy theme trunk builds prior to the patched release

Discovery Timeline

2026-06-09 - CVE-2026-8365 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-8365

Vulnerability Analysis

The vulnerability stems from two separate weaknesses that combine into a code execution chain. The blocksy_sanitize_post_meta_options() function performs insufficient input sanitization on post meta data accepted through the blocksy_meta REST API field. It only rejects values containing < or > characters and does not prevent serialized PHP object payloads from being stored in the database.

The second weakness lies in SearchReplacer::run_recursively(), used during database migration. This function unconditionally deserializes every string value via @unserialize() without supplying the allowed_classes option. Any serialized object stored anywhere reachable by the migration walker is instantiated when the V200 migration runs.

Once the malicious object instantiates, the Blocksy\RaiiPattern::__destruct() magic method fires during object destruction. The destructor invokes call_user_func() against attacker-controlled properties, allowing execution of arbitrary PHP callables in the context of the WordPress process.

Root Cause

The root cause is unsafe deserialization combined with weak input validation. The sanitizer enforces character-level filtering instead of structural validation of serialized data, and the migration routine deserializes without restricting allowed classes. Together they form a usable POP (Property-Oriented Programming) gadget chain rooted in the RaiiPattern class.

Attack Vector

An authenticated user with contributor-level access submits a crafted serialized Blocksy\RaiiPattern payload to the blocksy_meta REST API field. The payload persists in wp_postmeta. When an administrator upgrades the theme and the V200 migration executes, SearchReplacer::run_recursively() deserializes the payload, instantiating the gadget object whose destructor calls call_user_func() with attacker-supplied arguments. Implementation details are documented in the WordPress Blocksy DB Search Replacer source and the RAII Class source.

Detection Methods for CVE-2026-8365

Indicators of Compromise

Post meta records in wp_postmeta containing serialized strings beginning with O: and referencing the Blocksy\\RaiiPattern class name.
REST API requests to endpoints writing the blocksy_meta field from contributor-level accounts.
Unexpected child processes spawned by the PHP-FPM or webserver user immediately after a theme upgrade or wp_upgrade execution.
New or modified PHP files in wp-content/uploads/ or theme directories created shortly after migration runs.

Detection Strategies

Inspect database content for serialized PHP object signatures (O:, C:) within fields that should hold structured arrays or scalar values.
Audit WordPress access logs for POST or PUT requests to /wp-json/wp/v2/posts/*/meta containing RaiiPattern substrings.
Correlate theme upgrade events with subsequent process or file creation anomalies on the host.

Monitoring Recommendations

Enable WordPress audit logging for contributor-level and editor-level accounts, focusing on meta field writes.
Monitor outbound network connections initiated by the webserver process for indicators of reverse shell behavior.
Track integrity of WordPress core and theme files using file integrity monitoring tools.

How to Mitigate CVE-2026-8365

Immediate Actions Required

Upgrade the Blocksy theme to a version released after 2.1.41 once the vendor publishes the patched build referenced in the Wordfence Vulnerability Analysis.
Audit all contributor, author, and editor accounts and revoke any that are unused or untrusted.
Scan wp_postmeta for serialized objects containing Blocksy\\RaiiPattern and remove tainted rows before running migrations.

Patch Information

The vendor source tree shows the vulnerable code paths persist through versions 2.1.35 and 2.1.41. Site operators should apply the fixed version published by the Blocksy maintainers and verify that SearchReplacer::run_recursively() uses unserialize($value, ['allowed_classes' => false]) and that blocksy_sanitize_post_meta_options() rejects serialized payloads. Patched source references are tracked in the WordPress Blocksy Trunk source.

Workarounds

Restrict contributor-level and higher access to trusted users only until the patched version is deployed.
Disable or restrict access to the blocksy_meta REST API field via a Web Application Firewall (WAF) rule that blocks request bodies containing serialized object signatures (O:, C:).
Defer running the V200 database migration on upgraded sites until contributor-submitted post meta has been audited for serialized object payloads.

bash

# Configuration example - WP-CLI audit for suspicious serialized payloads
wp db query "SELECT post_id, meta_key, LEFT(meta_value, 200) AS preview \
  FROM wp_postmeta \
  WHERE meta_value LIKE 'O:%RaiiPattern%' \
     OR meta_value LIKE '%Blocksy\\\\RaiiPattern%';"