The Blocksy Companion plugin for WordPress contains an arbitrary file upload vulnerability that allows authenticated attackers to achieve remote code execution on the host server.

The plugin fails to perform sufficient file type validation for SVG uploads, which allows attackers with author-level privileges or higher to bypass sanitization by using double extensions. This flaw permits the upload of malicious files that can lead to remote code execution.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the underlying web server. This could lead to a complete compromise of the WordPress site, including unauthorized data access, modification of site content, or the installation of persistent backdoors. Given the CVSS score of 8.8, this vulnerability poses a high risk to organizational security and service availability.

Immediate Action: Update the Blocksy Companion plugin to the latest version (beyond 2.1.19) as provided by CreativeThemesHQ to implement correct file type validation.

Proactive Monitoring: Monitor server access logs for suspicious file uploads or access attempts to non-standard file types within the upload directory, particularly those originating from user accounts with author-level permissions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block uploads containing suspicious double file extensions or non-image content within the SVG upload flow.

Public Exploit Available: Unknown

Organizations utilizing the Blocksy Companion plugin must verify their current version and update immediately to the latest patched release. Because this flaw allows for remote code execution by authenticated users, it is imperative to audit current user roles and restrict administrative or author-level access to trusted personnel only until the patch is applied.