CVE-2026-57624: WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

Synopsis

An unauthenticated remote code execution vulnerability affects the Blocksy Companion Pro WordPress plugin at version 2.1.46 and earlier. The flaw is reachable over the network with no credentials required and no user interaction needed, allowing a remote attacker to execute arbitrary code on the host running the affected plugin. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. No fix version has been published yet; HarborGuard tracks the upstream advisory and will surface a patched-image rebuild the moment one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; the affected plugin endpoint is exposed via HTTP/HTTPS with no network-level restriction implied by the vulnerability itself.

• AuthenticationNot required

  No account or session token is needed; the attacker can trigger the vulnerability as a completely unauthenticated HTTP client.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted request directly to the server without involving any logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Executes arbitrary operating system commands or code in the context of the web server process, giving the attacker a foothold on the host.
• Reads any file accessible to the web server user, including WordPress configuration files containing database credentials and secret keys.
• Writes or modifies files on the server, enabling backdoor installation, defacement, or supply-chain tampering of served content.
• Crashes or degrades the web server process, taking the affected WordPress site offline.