Contributor RCE in Blocksy Companion Pro <= 2.1.37

Executive Summary

The WordPress Blocksy Companion Pro Plugin, specifically versions 2.1.37 and earlier, contains a Remote Code Execution (RCE) vulnerability. This flaw allows an attacker with contributor, developer, or creative privileges to execute arbitrary commands on the affected site.

This means the attacker can potentially gain backdoor access and full control over the website. The vulnerability is classified under the OWASP Top 10 category A3: Injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to execute arbitrary commands remotely on your website.

• Attackers can gain backdoor access to your site.
• Full control over the affected website can be obtained by the attacker.
• It poses a high risk due to its high CVSS score of 9.9, indicating critical severity.
• The vulnerability is likely to be exploited in mass campaigns targeting many websites.

Useful 0 Not Useful 0

Mitigation Strategies

Users are strongly advised to update the WordPress Blocksy Companion Pro Plugin to version 2.1.38 or later immediately to patch the Remote Code Execution vulnerability.

Until the update is applied, Patchstack has provided a mitigation rule to block attacks targeting this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote code execution, enabling attackers to gain backdoor access and full control over affected sites. Such unauthorized access and control can lead to data breaches, potentially exposing sensitive personal or health information.

This exposure could result in non-compliance with regulations like GDPR and HIPAA, which mandate strict protections for personal and health data. Organizations using vulnerable versions of the Blocksy Companion Pro plugin risk violating these standards if the flaw is exploited.

Therefore, timely patching to version 2.1.38 or later is critical to maintain compliance and protect sensitive data from compromise.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability affects WordPress sites running Blocksy Companion Pro plugin version 2.1.37 or earlier, allowing Remote Code Execution by users with contributor or higher privileges.

To detect if your system is vulnerable, first verify the installed plugin version. You can do this by checking the plugin version in the WordPress admin dashboard or by running commands on the server hosting WordPress.

• Check the plugin version via WP-CLI: wp plugin list | grep blocksy-companion-pro
• Inspect the plugin's main file for version info: grep 'Version' wp-content/plugins/blocksy-companion-pro/blocksy-companion-pro.php

Additionally, monitoring for suspicious activity such as unexpected command execution or unauthorized access attempts by contributor-level users can help detect exploitation attempts.

Patchstack provides a mitigation rule to block attacks until the plugin is updated, which can be applied as a temporary defense.

Useful 0 Not Useful 0