CVE-2026-15158: Critical Arbitrary File Upload Vulnerability in Blocksy Companion Plugin
A critical vulnerability (CVE-2026-15158, CVSS 9.8) exists in the Blocksy Companion plugin for WordPress, allowing unauthenticated attackers to upload executable files, leading to remote code execution. This vulnerability affects the premium version of the plugin (blocksy-companion-pro) when used with specific extensions. Immediate action is required to mitigate this threat.