WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability

Description

Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

Vendor	Product	Versions
blocksy	blocksy companion pro	n/a

Tier C

VulDB7d ago

→ No new info (linked only)

CVSS 3.15.3 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA KEV❌ No

Actively exploited✅ Yes

CWECWE-639

PublishedJun 26, 2026

Last enriched7d agov2

Trending Score17

Source articles1

Independent1

Info Completeness8/14

Missing: epss, kev, exploit, patch, iocs, mitre_attack

0 upvotes0 downvotes

Last enriched 7d ago

v2Tier C7d ago

Updated vendor to 'Creative mes', changed severity to HIGH, and noted that the exploit is not available.

descriptionseverityactivelyExploited

via VulDB

v17d ago

Initial creation