# Blockons <= 1.2.19 - Unauthenticated Limited File Upload via Contact Form Submission REST Endpoint

- **ID:** WPSEC-2026-1059
- **Plugin:** Blockons – Gutenberg blocks for WordPress and WooCommerce websites (`blockons`), https://wordpress.org/plugins/blockons/
- **Affected versions:** from 1.2.04 before 1.2.20
- **Fixed in:** 1.2.20 (Update to 1.2.20 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/blockons
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1059/

## Description

The Blockons plugin for WordPress is vulnerable to limited file uploads via the blcns/v1/submit-form REST endpoint in all versions up to, and including, 1.2.19, due to the handle_file_uploads() function accepting files under any field name, whether or not a form with a file field exists on the site, and storing them in a publicly accessible uploads directory under names derived from the original filename. This makes it possible for unauthenticated attackers to upload documents, images, plain text and media files of the plugin's allowed types to the server and host them on the site's domain.

## References

- https://wpsec.com/vuln/WPSEC-2026-1059/
- https://plugins.svn.wordpress.org/blockons/tags/1.2.20/
- https://wordpress.org/plugins/blockons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1059/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.