WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

Description

Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

Vendor	Product	Versions
blocksy	blocksy companion pro	n/a

Tier C

VulDB1d ago

→ No new info (linked only)

CVSS 3.110.0 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA KEV✅ Yes

Actively exploited✅ Yes

CWECWE-94

PublishedJul 2, 2026

Last enriched1d agov2

Trending Score97

Source articles1

Independent1

Info Completeness9/14

Missing: epss, exploit, patch, iocs, mitre_attack

0 upvotes0 downvotes

Last enriched 1d ago

v2Tier C1d ago

Updated vendor to 'creative mes', changed exploit availability to false, and provided a more detailed description of the vulnerability.

description

via VulDB

v11d ago

Initial creation