The Blocksy Companion plugin for WordPress contains an arbitrary file upload flaw that allows an unauthenticated attacker to upload a file with a double extension, such as shell.woff2.php, through the 'blc-review-images[]' parameter. The flaw stems from a custom validation filter that incorrectly accepts any filename containing ".woff2" or ".ttf" as a substring, rather than verifying the actual file extension. This permits files that are executable on the server to be stored as seemingly harmless font files, enabling remote code execution if the server is configured to execute the uploaded file type. The weakness is categorized as "Arbitrary File Upload" (CWE-434).

Blocksy Companion, developed by creativethemeshq, is affected in all releases up to and including version 2.1.46. The flaw is only exploitable when the premium blocksy‑companion‑pro version is installed together with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions. Installations of the free blocksy‑companion plugin are not vulnerable because the vulnerable code paths are absent.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. Its EPSS score is less than 1%, suggesting that exploitation opportunities are currently rare, and the flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the unauthenticated upload endpoint exposed by the plugin; an attacker can send a crafted request containing a malicious file name that passes on the server, and then trigger server’s file handling rules.