The vulnerability is an unauthenticated broken access control flaw in the Blocksy Companion plugin for WordPress. A remote attacker who can reach the plugin’s web interface can bypass the intended permission checks and execute privileged actions such as modifying or deleting plugin settings. This is a CWE‑862 issue and can compromise the confidentiality, integrity, and availability of the blogging platform if an attacker gains control of the plugin.

All installations of the Creative Themes Blocksy Companion plugin for WordPress that are running version 2.1.55 or earlier are susceptible. The vulnerability exists specifically in any instance where the plugin is active and accessible via a standard WordPress site URL. No information is available about which sub‑versions within 2.1.55 are affected, so the recommendation covers all 2.1.55 releases and earlier.

The CVSS score of 6.5 indicates a moderate severity. Exploitation is likely feasible from any external web request, and no authentication is required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because of the moderate magnitude, the risk is real if an attacker can interact with the WordPress site and the plugin is active. Patching removes the flaw; otherwise the risk remains until remediation.