Blocksy Companion WordPress Plugin Authenticated Arbitrary File Upload Vulnerability

A vulnerability allowing authenticated users with author-level access and above to upload arbitrary files has been identified in the Blocksy Companion plugin for WordPress, affecting all versions through 2.1.19. This issue arises from inadequate validation of file types for SVG uploads, which enables double extension files to circumvent proper sanitization and be accepted as legitimate SVGs. As a result, uploaded files could potentially be used to execute code remotely on the affected server.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, with the potential for remote code execution on the server where the vulnerable WordPress site is hosted.

Remediation

Users are advised to update the Blocksy Companion plugin to version 2.1.20 or a newer patched version.