Authenticated Arbitrary File Upload Vulnerability in Blocksy Companion Plugin for WordPress

CVE-2025-12846

What is CVE-2025-12846?

The Blocksy Companion plugin for WordPress has a vulnerability that allows authenticated users with author-level access to upload arbitrary files due to inadequate file type validation. Specifically, the plugin fails to properly identify and sanitize SVG files, allowing malicious actors to bypass security measures by uploading specially crafted double extension files. This weakness could facilitate remote code execution on the server of the affected WordPress site, compromising its security and integrity.

References