Blocksy Companion 2.1.46 - RCE

ExploitDBExploitDB exploitExploitEDB-52640

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends an unauthenticated POST request to upload a PHP web shell (poc.woff2.php) via the blc-review-images[] parameter to the admin-ajax.php endpoint, exploiting a double-extension file upload bypass in Blocksy Companion <= 2.1.46.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward unauthenticated file upload exploit for CVE-2026-58480. It uploads a minimal PHP webshell that executes commands passed via a GET parameter. No concealed behavior, persistence mechanisms, credential theft, or unrelated payloads are present. The code is fully readable and contains no obfuscation or deceptive functionality.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareBlocksy CompanionWordPress
Attack typesremote code executionunrestricted file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a PHP web shell to the target server and provides instructions for executing arbitrary commands, which constitutes exploitation rather than mere detection or scanning.

exploits/multiple/webapps/52640.py:61-69exploits/multiple/webapps/52640.py:79-85

Requirements

  • Target must run Blocksy Companion <= 2.1.46 with Advanced Reviews and Custom Fonts extensions enabled.exploits/multiple/webapps/52640.py:12exploits/multiple/webapps/52640.py:28
  • Target URL must be supplied as a command-line argument.exploits/multiple/webapps/52640.py:53-56

Observed behavior

  • Constructs a PHP payload that executes system commands via the 'cmd' GET parameter.exploits/multiple/webapps/52640.py:62-69
  • Sends an unauthenticated POST request to /wp-admin/admin-ajax.php with the payload as blc-review-images[] and action=blc_save_review_attachments.exploits/multiple/webapps/52640.py:71-81
  • Prints the HTTP status and response, then instructs the user to access the uploaded shell in wp-content/uploads/.exploits/multiple/webapps/52640.py:82-85
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Payload
<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); exit; } echo 'Blocksy RCE PoC - CVE-2026-58480 | @banyamer_security'; ?>The uploaded payload is a simple PHP webshell that executes commands supplied via the 'cmd' GET parameter. This is the intended exploit behavior for the stated CVE and does not constitute a backdoor beyond the advertised RCE.exploits/multiple/webapps/52640.py:62-69
Exploit Mechanism
Unauthenticated POST to /wp-admin/admin-ajax.php with action=blc_save_review_attachments and file upload via blc-review-images[] parameterThe exploit uses the documented vulnerability to upload a file with a double extension (poc.woff2.php) to bypass extension validation. This is consistent with the CVE description and does not involve any hidden or unrelated actions.exploits/multiple/webapps/52640.py:71-81
Review boundaries

What the analysis did not establish

  • Only the exploit script is provided; external dependencies (requests library) and the target environment are not included.
  • The script's actual effectiveness is not verified; classification is based solely on the code's apparent intent.
  • Only the exploit script text was reviewed; no network traffic or runtime behavior was observed.
  • The review does not assess the safety or reliability of the exploit, only the absence of backdoor behavior within the provided code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1