Blocksy Companion Pro plugin for WordPress contains an unauthenticated arbitrary file upload vulnerability (CWE‑434) that allows attackers to upload executable files via the Advanced Reviews feature. The flaw lies in the save_attachments function, which validates file types by checking for a known substring in the file extension. Because this validation only inspects a substring, an attacker can supply a double‑extension filename such as shell.woff2.php; the substring check passes while the web server interprets the final extension as PHP, executing the file. This results in full remote code execution on the server, compromising confidentiality, integrity and availability of the entire site.

The vulnerability affects the Creative Themes Blocksy Companion Pro plugin for WordPress. Any instance of the plugin with a version lower than 2.1.47 remains susceptible. WordPress sites that have installed the plugin without upgrading to 2.1.47 or later are at risk.

The CVSS score of 9.2 designates this flaw as critical, and the EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires no authentication; an attacker simply submits a crafted attachment to the public Advanced Reviews upload endpoint, causing the web server to execute the uploaded file as PHP and granting arbitrary command execution on the host system.