BaseFortify

Publication date: 2025-11-11

Last updated on: 2025-11-12

Assigner: Wordfence

Description

The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-11

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12846

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	blocksy_companion	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in the Blocksy Companion plugin for WordPress allows authenticated users with author level access or higher to upload arbitrary files due to insufficient validation of file types. Specifically, the plugin fails to properly detect SVG files and allows files with double extensions to bypass sanitization, accepting them as valid SVG files. This can lead to the possibility of remote code execution on the affected server.

Impact Analysis

If exploited, this vulnerability can allow an attacker with author level access or above to upload malicious files to the server, potentially leading to remote code execution. This can compromise the security and integrity of the website and server, allowing unauthorized control, data theft, or further attacks.

Hi! I’m here to help you understand CVE-2025-12846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70