CVE-2026-57630
Deferred Deferred - Pending Action

IDOR Vulnerability in Blocksy Companion Pro <= 2.1.46

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-07-16
AI Q&A
2026-06-26
EPSS Evaluated
2026-07-15
NVD
CVE-2026-57630
EUVD
EUVD-2026-39746

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
blocksy companion_pro to 2.1.46 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability is an Insecure Direct Object References (IDOR) issue in the WordPress Blocksy Companion Pro Plugin versions 2.1.46 and below.

It allows unauthorized users to bypass authentication and access sensitive files, folders, or interact with the database due to improper authorization checks.

This means attackers can directly access resources they should not be able to, without logging in.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files and data within the affected WordPress plugin.

Although the severity is considered low with a CVSS score of 5.3, attackers may exploit it in large-scale campaigns targeting many websites.

Such unauthorized access could compromise the confidentiality of your data and potentially expose sensitive information.

Users are strongly advised to update to version 2.1.47 or later to mitigate this risk.

Compliance Impact

The vulnerability allows unauthorized users to bypass authentication and access sensitive files, folders, or interact with the database due to improper authorization checks.

Such unauthorized access to sensitive data could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, which require strict controls over access to personal and sensitive information.

However, the provided information does not explicitly mention the impact on compliance with these standards.

Mitigation Strategies

The vulnerability in Blocksy Companion Pro versions 2.1.46 and below allows unauthorized access due to improper authorization checks.

Immediate mitigation steps include updating the plugin to version 2.1.47 or later, which contains the patch for this issue.

Users of Patchstack can enable auto-updates for vulnerable plugins to ensure timely patching.

If updating immediately is not possible, users should seek assistance from their hosting provider or web developer.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart