CVE-2026-57624: Critical Unauthenticated RCE in Blocksy Companion Pro

How to identify exposure in your environment

Start with asset inventory. Enumerate all WordPress instances, then identify where Blocksy Companion Pro is installed and whether the version is 2.1.46 or earlier. In centrally managed environments, WP-CLI is usually the fastest route. In shared hosting or outsourced site management, ask the provider for plugin version evidence rather than a verbal assurance that “everything is updated.”

A second step is retrospective scoping. Because the vulnerability is unauthenticated RCE, you should review recent activity on any affected site even if you patch immediately. Focus on sudden file changes, unexpected PHP files in writable locations, newly created administrator accounts, plugin or theme modifications, suspicious POST requests to WordPress endpoints, and outbound traffic from web servers that normally have no reason to initiate remote connections.

Technical Notes

Use WP-CLI to enumerate the plugin and version:

wp plugin list --format=table | grep -i blocksy
wp plugin get blocksy-companion-pro --fields=name,status,version

If WP-CLI is unavailable, check the plugin metadata directly on disk:

grep -E "Version:" wp-content/plugins/blocksy-companion-pro/blocksy-companion-pro.php

Example filesystem hunting for recently modified PHP files:

find /var/www/html -type f -name "*.php" -mtime -7 | sort
find wp-content/uploads -type f \( -name "*.php" -o -name "*.phtml" \) -print

Concrete log review patterns to start with, given the exact vulnerable endpoint is not yet publicly documented, should focus on suspicious unauthenticated requests to WordPress and plugin paths:

# Apache/Nginx access logs: requests into wp-admin/admin-ajax.php, REST API, or plugin paths
egrep 'POST .*wp-admin/admin-ajax\.php|POST .*wp-json/|/wp-content/plugins/blocksy-companion-pro/' /var/log/nginx/access.log /var/log/apache2/access.log

# Suspicious PHP execution attempts or direct access to writable areas
egrep '(/wp-content/uploads/.*\.php|/wp-content/cache/.*\.php|cmd=|exec=|base64_)' /var/log/nginx/access.log /var/log/apache2/access.log

Example Splunk query for suspicious WordPress web requests:

index=web (uri_path="/wp-admin/admin-ajax.php" OR uri_path="/wp-json/*" OR uri_path="*/wp-content/plugins/blocksy-companion-pro/*")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip http_method uri_path status user_agent
| sort - count

Because the vulnerable parameter or endpoint is not publicly confirmed in the available record, defenders should cast a wider net. Watch for POST-heavy traffic spikes, unusual user agents, 200 responses to plugin-path requests, and any subsequent file write or process execution events on the host.

Mitigation and patching guidance

The primary mitigation is to upgrade Blocksy Companion Pro to version 2.1.47 or later. That is the only clearly documented fixed boundary in the current public data. If you manage multiple sites, prioritize internet-facing instances and any site with weak monitoring, broad file write permissions, or colocated workloads on the same host.

If immediate patching is not possible, use compensating controls while treating them as temporary risk reduction, not a substitute for the fix. Consider temporarily disabling the plugin if the business impact is acceptable. Restrict administrative access paths with IP allowlists or VPN requirements where feasible. Increase monitoring on the web tier and file system, and verify backups are intact and restorable before making emergency changes.

Technical Notes

WP-CLI upgrade command:

wp plugin update blocksy-companion-pro --version=2.1.47

If your environment allows only general latest-version upgrades:

wp plugin update blocksy-companion-pro

Temporary disablement if you cannot patch immediately:

wp plugin deactivate blocksy-companion-pro

For managed package or deployment pipelines, ensure the plugin artifact is replaced in code repositories or build images, not just in production. Example manual verification after upgrade:

wp plugin get blocksy-companion-pro --fields=name,status,version
# Expected version: 2.1.47 or later

If WordPress admin access is your only option, verify the plugin version after updating and document which sites were remediated. In the absence of a retrievable vendor changelog during this research session, defenders should rely on the NVD version boundary: 2.1.46 and earlier affected, 2.1.47 fixed.

Post-patch incident response checks

Patching closes the known vulnerable version window, but it does not answer whether a site was already compromised. For any site that was exposed with Blocksy Companion Pro <= 2.1.46, perform at least a basic compromise assessment. Review newly created admin users, changed passwords, plugin/theme file diffs, scheduled tasks, and suspicious outbound connections from the host. On shared hosting, ask the provider for process execution logs or malware scan results if you do not control the OS.

Also review persistence mechanisms common in WordPress intrusions: dropped PHP files in uploads, modified functions.php, injected code in wp-config.php, .htaccess redirects, unauthorized MU-plugins, and database entries that add admin accounts or malicious options. If you find evidence of compromise, rotate WordPress admin credentials, database credentials, hosting panel credentials, and any API keys stored on the server.

References