The vulnerability exists because Blocksy Companion fails to properly validate uploaded file types, specifically allowing SVG uploads that contain a double file extension. This flaw lets an authenticated user with author or higher privileges upload any file to the site’s server. Once stored, non‑SVG payloads could be executed, resulting in remote code execution.

The affected product is the Blocksy Companion WordPress plugin, versions up to and including 2.1.19.

The CVSS score of 8.8 classifies this as high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires valid author+ credentials and relies on the double extension bypass to sidestep file type checks, enabling attackers to place arbitrary files on the server.