Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
Priority MEDIUM 53CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.
Summary
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Blocksy Companion (Unknown): 1.8.82
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Blocksy Companion | before 1.8.82 | 1.8.82 | Patch available | CNA |
- Blocksy Companion VendorUnknown Affected before 1.8.82 Fixed in 1.8.82 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:creativethemes:blocksy_companion:*:*:*:*:*:wordpress:*:* | before 1.8.82 | Vulnerable | creativethemeshq |
- cpe:2.3:a:creativethemes:blocksy_companion:*:*:*:*:*:wordpress:*:* Versions before 1.8.82 Vulnerable ·creativethemeshq
Remediation
- Fix · CNA Blocksy Companion (Unknown) Fixed in 1.8.82
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1911
- 2026-10-03 Alias added: GHSA-v7cp-3qx6-ff4r
References
More creativethemeshq Blocksy Companion vulnerabilities
- TI-2024-21035 WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
- TI-2024-04174 Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads CVSS 3.1MEDIUM 6.4
- TI-2024-02222 Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
- TI-2023-09697 WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.5
- TI-2024-23502 WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability CVSS 3.1MEDIUM 4.9
Sources
- CVE-2023-1911 · CVE Program
- CVE-2023-1911 · NVD
- FIRST EPSS
- GHSA-v7cp-3qx6-ff4r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences