Critical WordPress Plugin Flaw and Microsoft Dynamics 365 Vulnerability

Two critical vulnerabilities have been published in the last 24 hours, both requiring immediate attention from UK small businesses. CVE-2026-58480 affects Blocksy Companion Pro, a widely deployed WordPress plugin, scoring 9.8 on the CVSS severity scale. The flaw allows unauthenticated remote code execution through inadequate file upload validation, enabling attackers to upload and execute malicious PHP files by exploiting a substring matching error in the plugin’s validation logic. CVE-2026-47646 targets Microsoft Dynamics 365 Customer Voice with a CVSS score of 9.3, enabling unauthenticated cross-site scripting attacks that facilitate spoofing of legitimate business communications. This week, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue, including two Joomla plugin flaws with maximum CVSS scores of 10.0, both involving identical file upload validation failures. The pattern is clear: CMS plugins with inadequate upload validation are being systematically targeted through automated scanning. Small businesses must verify that Blocksy Companion Pro has been updated to version 2.1.47 immediately, confirm their web providers have documented patch management processes, and ensure Microsoft 365 automatic updates are enabled. The gap between vulnerability publication and active exploitation is now measured in hours, making same-day patching essential for maintaining security posture and meeting Cyber Essentials certification requirements.

Chapters

• Introduction Corrine introduces two critical vulnerabilities published in the last 24 hours: a 9.8 severity WordPress plugin flaw and a 9.3 Microsoft survey tool vulnerability, both exploitable without authentication.
• CVE-2026-58480: WordPress Plugin With a 9.8 Score Detailed analysis of the Blocksy Companion Pro vulnerability allowing unauthenticated remote code execution through inadequate file upload validation. The plugin’s use of substring matching instead of proper extension checking enables attackers to upload malicious PHP files disguised with .woff2 in the filename.
• Call to Action Brief request for listeners to follow the show, leave ratings, and share the episode with others managing WordPress sites or small businesses.
• CVE-2026-47646: Microsoft Dynamics 365 Customer Voice Examination of the cross-site scripting vulnerability in Microsoft Dynamics 365 Customer Voice that enables spoofing attacks, allowing attackers to craft malicious content appearing to originate from legitimate business survey infrastructure.
• The Pattern Behind This Week’s Alerts Analysis of CISA’s addition of four vulnerabilities to its Known Exploited Vulnerabilities catalogue, including two Joomla plugin flaws with 10.0 CVSS scores, highlighting the systematic targeting of CMS plugins with inadequate file upload validation.
• Why Your MSP’s Answer Matters Discussion of the importance of verifying that web providers have documented patch management processes and service levels, with specific guidance on questions to ask regarding the Blocksy vulnerability and Cyber Essentials certification requirements.
• Making the Business Case Three arguments for prioritising patch management: the zero cost of patching versus breach response costs, the public exposure of websites as attack surfaces, and the regulatory expectations around known-exploited vulnerabilities.
• What to Do Before the End of Today Five concrete actions: verify Blocksy Companion Pro version, review all plugin updates, contact web providers in writing, enable Microsoft 365 automatic updates, and review file upload validation logic.
• Closing Final emphasis that the gap between vulnerability publication and exploitation is measured in hours, making same-day patching essential for critical severity vulnerabilities.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog