CVE-2026-39596: WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability

Synopsis

SQL injection in the Blocksy Companion Pro WordPress plugin (versions before 2.1.29) allows an unauthenticated remote attacker to send crafted HTTP requests directly to the vulnerable endpoint without any login or session. Exploitation gives the attacker read access to database contents and can partially disrupt service availability. A patched-image rebuild at version 2.1.29 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is needed, making any internet-exposed or internally networked instance a viable target.

• AuthenticationNot required

  No account, session token, or privilege level is needed; the vulnerable endpoint accepts and processes malicious SQL payloads from anonymous requests.

• Victim interactionNot required

  The attacker sends crafted requests directly to the service; no user action such as clicking a link or opening a file is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, specific memory layout, or environmental prerequisite is required to trigger the injection.

Blast Radius

• The attacker can read arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), session tokens, and any customer or order records held in the database.
• Scope is marked Changed in the CVSS vector, meaning the injected queries can reach data outside the plugin's own tables and affect other components sharing the database instance.
• Availability impact is rated Low, meaning the attacker can cause partial service disruption, such as resource exhaustion from expensive injected queries, without a full crash.