Description

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-30T13:17:36.697Z",
  "pubdate": "2026-09-30T13:17:36.697Z",
  "executiveSummary": "The Blocksy Companion plugin, specifically in versions 2.1.55 and below, contains a critical Broken Access Control vulnerability. This security flaw allows unauthenticated remote attackers to perform unauthorized actions or access restricted administrative functionality due to improper validation of user permissions within the plugin's request handling mechanisms.\nThe vulnerability arises from missing or improperly implemented authorization checks on critical internal functions. An attacker can exploit this condition without needing prior authentication or elevated privileges, potentially leading to unauthorized configuration changes, data exposure, or other administrative-level operations.\nGiven that Blocksy Companion is a widely used WordPress utility, the attack surface is significant. This vulnerability presents a high risk to affected WordPress installations, as it facilitates full unauthorized control over the plugin's features. Successful exploitation requires no specialized access, and the impact depends on the specific functions exposed through the affected endpoints. System administrators must prioritize updates to secure their environments against potential exploitation attempts.",
  "technicalDetails": "The vulnerability is rooted in a failure of the Blocksy Companion plugin to correctly enforce access control constraints on specific AJAX or REST API endpoints. The root cause is the absence of rigorous verification of the current user's security context (e.g., capability checks or nonce validation) within the vulnerable plugin controllers or action handlers.\nIn WordPress, plugin developers are expected to utilize functions like current_user_can() and verify nonces during the execution of sensitive administrative requests. In the identified affected versions (<= 2.1.55), the plugin fails to implement these checks, rendering the associated functions reachable by any user, including unauthenticated entities, by sending a direct HTTP request to the designated WordPress admin-ajax.php or REST API endpoint.\nThe attack flow typically involves an attacker identifying the specific action identifier associated with a privileged function within the plugin's source code. Once the endpoint is discovered, the attacker constructs an HTTP POST or GET request that includes the necessary parameters required by the function. Since the plugin performs no server-side checks to verify if the requester has administrative privileges, the WordPress backend processes the request as a legitimate administrative action.\nThe scope of impact is contingent upon the functions made public by this oversight. If the vulnerable endpoints manage settings, import/export operations, or plugin-specific configurations, the attacker can manipulate these values at will. This could potentially allow an attacker to alter the appearance of the site, inject malicious content, or interact with other plugins that rely on the Blocksy Companion's state.\nBecause this flaw is accessible via the network layer without requiring active sessions, the exposure is critical. The lack of authentication requirements effectively bypasses the standard perimeter security of the WordPress installation, enabling unauthorized remote code path execution or state modification within the context of the vulnerable plugin."
}