CVE-2026-15158 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-15158 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-15158 is an arbitrary file upload vulnerability in the Blocksy Companion plugin for WordPress, affecting all versions up to and including 2.1.46, introduced through the Custom Fonts extension via the save_attachments function.

Technical Detail

The flaw exists in the save_attachments function within the Custom Fonts extension of the Blocksy Companion plugin, which fails to adequately validate or restrict the file types that can be uploaded by a user. An attacker who can reach this function, potentially without elevated privileges depending on access controls in place, can upload a malicious file such as a PHP web shell to the server. Successful exploitation would likely result in remote code execution (RCE) under the web server process context, giving an attacker the ability to execute arbitrary commands, exfiltrate data, or establish persistent access to the host.

Exploitation Status

No known exploit has been publicly documented or observed as of July 16, 2026. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.8 and the straightforward nature of file upload vulnerabilities mean that exploitation risk should not be discounted, as this class of flaw is frequently targeted once details become public.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability in available intelligence sources.

What To Do

Update the Blocksy Companion plugin to a version beyond 2.1.46 immediately. Site administrators should verify the installed version via the WordPress dashboard and apply the patch as a priority given the critical severity rating. If an immediate update is not possible, consider disabling the Custom Fonts extension within the Blocksy Companion plugin as a temporary workaround to reduce the attack surface. Detection efforts should focus on monitoring web server logs for unexpected file uploads to plugin-related directories, particularly files with executable extensions such as .php, .phtml, or .phar. Web application firewall rules restricting file upload content types to legitimate font formats can provide an additional layer of defense while patching is completed.