CVE-2026-57624

CriticalCVSS 10.0/10Last modified Jul 2, 2026

Description

Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 2, 2026
Last modified
Jul 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-576259.6Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.CVE-2026-576267.1Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 thrCVE-2026-576274.9Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.CVE-2026-576287.6Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-576296.5Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.CVE-2026-576305.3Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-576317.6Administrator SQL Injection in Popup box <= 6.0.1 versions.CVE-2026-576325.4Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.CVE-2026-576335.3Unauthenticated Sensitive Data Exposure in WCBoost &#8211; Products Compare <= 1.1.0 versions.CVE-2026-576344.3Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.CVE-2026-576356.5Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.CVE-2026-576368.5Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.
CVE-2026-57624: Critical severity, CVSS 10.0 | Vulnix