Executive Summary

The Blocksy theme for WordPress has a vulnerability called PHP Object Injection that can lead to Remote Code Execution. This happens through the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35.

The root cause is insufficient input sanitization in the function blocksy_sanitize_post_meta_options(), which only blocks values containing '<' or '>' but does not prevent serialized PHP object strings from being stored in post meta.

During the V200 migration, the SearchReplacer::run_recursively() function deserializes all string values without restricting allowed classes. This allows an authenticated attacker with contributor-level access or higher to inject a serialized Blocksy\RaiiPattern object into post meta.

When the migration runs, the injected object is deserialized and triggers the RaiiPattern::__destruct() method, which executes arbitrary PHP callables via call_user_func(), enabling remote code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with contributor-level access or higher to execute arbitrary PHP code on your WordPress site remotely.

Such remote code execution can lead to full site compromise, including data theft, site defacement, installation of malware, or further attacks on the hosting environment.

Because the vulnerability requires only contributor-level privileges, it significantly lowers the barrier for attackers to exploit the site.

Useful 0 Not Useful 0