CVE-2025-12846

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12846", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-06T20:53:02.971Z", "datePublished": "2025-11-11T11:03:46.642Z", "dateUpdated": "2026-04-08T17:33:57.002Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:57.002Z"}, "affected": [{"vendor": "creativethemeshq", "product": "Blocksy Companion", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8615422-5db7-495d-9956-7d6f658f42bf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3391933/blocksy-companion/trunk/framework/features/svg.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-10-30T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-06T21:40:43.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-10T22:26:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T15:22:53.011947Z", "id": "CVE-2025-12846", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:29:19.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12846", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-14T15:22:53.011947Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:22:53.784Z"}}], "cna": {"title": "Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "creativethemeshq", "product": "Blocksy Companion", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.1.19"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-30T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-06T21:40:43.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-10T22:26:41.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8615422-5db7-495d-9956-7d6f658f42bf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3391933/blocksy-companion/trunk/framework/features/svg.php"}], "descriptions": [{"lang": "en", "value": "The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-11T11:03:46.642Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12846", "state": "PUBLISHED", "dateUpdated": "2025-11-14T15:29:19.575Z", "dateReserved": "2025-11-06T20:53:02.971Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T11:03:46.642Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Blocksy Companion", "vendor": "creativethemeshq", "versions": [{"lessThanOrEqual": "2.1.19", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin Blocksy Companion para WordPress es vulnerable a la carga autenticada de archivos arbitrarios en todas las versiones hasta la 2.1.19, inclusive. Esto se debe a una validaci\u00f3n insuficiente del tipo de archivo al detectar archivos SVG, permitiendo que archivos con doble extensi\u00f3n eludan la sanitizaci\u00f3n mientras son aceptados como un archivo SVG v\u00e1lido. Esto hace posible que atacantes autenticados, con acceso de nivel de autor y superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-12846", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12846", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T15:22:53.011947Z", "version": "2.0.3"}}]}, "published": "2025-11-11T11:15:35.060", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3391933/blocksy-companion/trunk/framework/features/svg.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8615422-5db7-495d-9956-7d6f658f42bf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:39:55.615712+00:00", "value": {"mitigation_remediation": ["Upgrade Blocksy Companion to version 2.1.20 or later.", "Avoid using author+ accounts for site administration and restrict upload capabilities for such roles.", "Configure WordPress or the web server to enforce strict MIME type validation, rejecting non\u2011SVG uploads and disallowing executable file types in upload directories."], "summary": {"action": "Patch Immediately", "impact": "Authenticated Arbitrary File Upload leading to potential Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is the Blocksy Companion WordPress plugin, versions up to and including 2.1.19.", "description_and_impact": "The vulnerability exists because Blocksy Companion fails to properly validate uploaded file types, specifically allowing SVG uploads that contain a double file extension. This flaw lets an authenticated user with author or higher privileges upload any file to the site\u2019s server. Once stored, non\u2011SVG payloads could be executed, resulting in remote code execution.", "risk_and_exploitability": "The CVSS score of 8.8 classifies this as high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires valid author+ credentials and relies on the double extension bypass to sidestep file type checks, enabling attackers to place arbitrary files on the server."}}}}, "created": "2025-11-12T12:42:41.761965+00:00", "updated": "2026-04-21T01:45:24.443074+00:00", "vendors": ["creativethemes", "creativethemes$PRODUCT$blocksy_companion", "wordpress", "wordpress$PRODUCT$wordpress"]}