CVE-2026-40783: WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability

Synopsis

This is a remote code execution vulnerability in the Blocksy Companion Pro WordPress plugin (versions 2.1.37 and earlier). It is reachable over the network and requires only a low-privilege (contributor-level) WordPress account to exploit, with no victim interaction needed. Successful exploitation gives an attacker full code execution on the host server, and the scope extends beyond the WordPress application itself. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can reach it from the internet or any network path to the WordPress installation without needing local or physical access.

• AuthenticationRequired

  A low-privilege WordPress account (contributor role or equivalent) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker can trigger the vulnerability directly against the application.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the web server process, gaining direct control over the server environment.
• Because the CVSS scope is Changed, the attacker can break out of the WordPress application boundary and affect the underlying host or co-located services.
• Confidential data stored on the server, including database credentials, environment variables, and stored user content, is fully readable.
• The attacker can write, modify, or delete files and database records, and can crash or disrupt the affected service.