GHSA-R622-C48H-H6QQ

Vulnerability from github – Published: 2026-06-09 09:32 – Updated: 2026-06-09 09:32
VLAI
Details

The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '<' or '>' and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8365"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T09:16:31Z",
    "severity": "HIGH"
  },
  "details": "The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the \u0027blocksy_meta\u0027 REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing \u0027\u003c\u0027 or \u0027\u003e\u0027 and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().",
  "id": "GHSA-r622-c48h-h6qq",
  "modified": "2026-06-09T09:32:07Z",
  "published": "2026-06-09T09:32:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8365"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.35/admin/helpers/meta-boxes.php#L104"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.35/admin/helpers/validator.php#L75"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.35/inc/classes/db-versioning/utils/db-search-replacer.php#L98"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.35/inc/classes/raii.php#L12"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.41/admin/helpers/meta-boxes.php#L104"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.41/admin/helpers/validator.php#L75"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.41/inc/classes/db-versioning/utils/db-search-replacer.php#L98"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/2.1.41/inc/classes/raii.php#L12"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/trunk/admin/helpers/meta-boxes.php#L104"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/trunk/admin/helpers/validator.php#L75"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/trunk/inc/classes/db-versioning/utils/db-search-replacer.php#L98"
    },
    {
      "type": "WEB",
      "url": "https://themes.trac.wordpress.org/browser/blocksy/trunk/inc/classes/raii.php#L12"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fd216743-ce8d-4632-9fd1-d63502c2dfcd?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.