CVE Alert: CVE-2025-12846 – creativethemeshq – Blocksy Companion

Risk verdict

High risk of authenticated arbitrary file upload with potential remote code execution; patch promptly and monitor until fixes are deployed.

Why this matters

Authenticated authors can upload malicious SVGs that bypass sanitisation, potentially enabling server compromise, data exfiltration, or site defacement. In typical WordPress deployments, a single vulnerable plugin can serve as a foothold for broader compromise across hosted environments.

Most likely attack path

• Attacker requires author-level access (low precondition).
• Network-based vector: upload of an SVG that bypasses file-type validation due to double-extension handling, enabling arbitrary file storage on the server.
• High impact: if the server processes the uploaded file or the SVG payload triggers code execution, attacker may achieve RCE or pivots within the hosting environment.

Who is most exposed

WordPress sites using Blocksy Companion <= 2.1.19 with author+ roles and enabled file uploads; hosting setups that execute or serve user-uploaded content (including SVGs) are at greatest risk.

Detection ideas

• Alerts for SVG uploads with double extensions or non-standard SVG content.
• Post-upload writes to web-accessible uploads directories, especially with executable payloads.
• Logs showing SVG uploads from author accounts, or anomalous activity immediately after upload.
• Unexpected 500/500-series errors linked to upload handling.
• Elevated activity by author accounts around upload events.

Mitigation and prioritisation

• Apply the Blocksy Companion update to a fixed version (2.1.20+).
• Disable or strictly restrict SVG uploads; implement strict MIME/extension validation and remove double extensions.
• Enforce least privilege for author+ accounts; review and normalise user roles.
• Add input validation and content sanitisation for uploads; consider sandbox execution checks.
• Deploy WAF rules and enable focused monitoring on the uploads path; perform staged testing prior to full rollout.