CVE Explorer
CVE-2026-8365
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '<' or '>' and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() func
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Blocksy","vendor":"creativethemeshq","versions":[{"lessThanOrEqual":"2.1.41","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/problemTypes/0/descriptions/0
Source references
13 source assertions{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.35/admin/helpers/meta-boxes.php#L104"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/10
{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.35/admin/helpers/validator.php#L75"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/11
{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.35/inc/classes/db-versioning/utils/db-search-replacer.php#L98"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/9
{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.35/inc/classes/raii.php#L12"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/12
{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.41/admin/helpers/meta-boxes.php#L104"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/4
{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.41/admin/helpers/validator.php#L75"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/6
{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.41/inc/classes/db-versioning/utils/db-search-replacer.php#L98"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/2
{"url":"https://themes.trac.wordpress.org/browser/blocksy/2.1.41/inc/classes/raii.php#L12"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/8
{"url":"https://themes.trac.wordpress.org/browser/blocksy/trunk/admin/helpers/meta-boxes.php#L104"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/3
{"url":"https://themes.trac.wordpress.org/browser/blocksy/trunk/admin/helpers/validator.php#L75"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/5
{"url":"https://themes.trac.wordpress.org/browser/blocksy/trunk/inc/classes/db-versioning/utils/db-search-replacer.php#L98"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/1
{"url":"https://themes.trac.wordpress.org/browser/blocksy/trunk/inc/classes/raii.php#L12"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/7
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd216743-ce8d-4632-9fd1-d63502c2dfcd?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:047a4e1d30e139dcefdf10049518c7e008c433e1893f9a5bfda833c957490f3a · sha256:f9f32257f8482e0a… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.