Vulnerabilities / Blockons / WPSEC-2026-1059
Blockons <= 1.2.19 - Unauthenticated Limited File Upload via Contact Form Submission REST Endpoint
Medium 5.3
CWE-434Fixed in 1.2.20
- ID
- WPSEC-2026-1059
- Plugin
- Blockons – Gutenberg blocks for WordPress and WooCommerce websites (blockons)
- Affected
- from 1.2.04 before 1.2.20
- Remediation
- Update to 1.2.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- Blockons on WPSec AttackSurface
- Fix released
- Published
Description
The Blockons plugin for WordPress is vulnerable to limited file uploads via the blcns/v1/submit-form REST endpoint in all versions up to, and including, 1.2.19, due to the handle_file_uploads() function accepting files under any field name, whether or not a form with a file field exists on the site, and storing them in a publicly accessible uploads directory under names derived from the original filename. This makes it possible for unauthenticated attackers to upload documents, images, plain text and media files of the plugin's allowed types to the server and host them on the site's domain.
References
- https://wpsec.com/vuln/WPSEC-2026-1059/
- https://plugins.svn.wordpress.org/blockons/tags/1.2.20/
- https://wordpress.org/plugins/blockons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS