Blocksy Companion Vulnerability – Cross-Site Request Forgery – CVE-2024-31932 | WordPress Plugin Vulnerability Report 

Plugin Name: Blocksy Companion

Key Information:

  • Software Type: Plugin
  • Software Slug: blocksy-companion
  • Software Status: Active
  • Software Author: creativethemeshq
  • Software Downloads: 7,114,824
  • Active Installs: 200,000
  • Last Updated: April 24, 2024
  • Patched Versions: 2.0.29
  • Affected Versions: <= 2.0.28

Vulnerability Details:

  • Name: Blocksy Companion <= 2.0.28
  • Title: Cross-Site Request Forgery
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-31932
  • CVSS Score: 5.3
  • Publicly Published: April 10, 2024
  • Researcher: Vladislav Pokrovsky (ΞX.MI) - Independent AppSec Researcher
  • Description: The Blocksy Companion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.28. This vulnerability arises from missing or incorrect nonce validation on several functions, allowing unauthenticated attackers to perform unauthorized actions via a forged request, provided they can deceive a site administrator into clicking a link.


The Blocksy Companion plugin, integral for enhancing WordPress site capabilities, contains a vulnerability in versions up to and including 2.0.28 that allows unauthorized actions through forged requests due to inadequate nonce validation. This critical issue has been resolved in the recently released patch version 2.0.29.

Detailed Overview:

This vulnerability poses a significant risk as it enables unauthenticated attackers to manipulate the site's functionality by exploiting the trust between the website and the user's browser. The flaw could potentially lead to changes in site settings, content alterations, or other unauthorized actions without the site administrator's consent. The resolution in version 2.0.29 addresses these nonce validation issues, thus securing the plugin from similar vulnerabilities in the future.

Advice for Users:

  • Immediate Action: It is crucial for users of the Blocksy Companion plugin to update to the patched version, 2.0.29, immediately to mitigate the risk associated with this vulnerability.
  • Check for Signs of Vulnerability: Site administrators should inspect their site’s logs for any unauthorized or unusual activities that might indicate this vulnerability has been exploited.
  • Alternate Plugins: While the patched version is secure, users may consider evaluating other feature-rich plugins that consistently demonstrate robust security measures as an additional precaution.
  • Stay Updated: Regular updates to plugins and other website components are essential to maintaining security and functionality, protecting against known vulnerabilities.


The quick response by the developers of Blocksy Companion to patch the CSRF vulnerability highlights the importance of timely software updates. Users are advised to ensure they are running version 2.0.29 or later to safeguard their WordPress installations. This incident underlines the critical nature of ongoing vigilance and proactive security measures in managing a secure and reliable digital presence.


Detailed Report: 

In today's digital world, the security of your website is as crucial as its content. For those utilizing WordPress, plugins significantly enhance functionality but can also pose risks if not properly managed. A recent case in point is the discovery of a serious security vulnerability in the widely used "Blocksy Companion" plugin, which has prompted urgent updates and a reevaluation of security practices across the board. Identified as CVE-2024-31932, this vulnerability underscores the importance of vigilance and timely updates in the cybersecurity domain.

About the Plugin: Blocksy Companion

Blocksy Companion, developed by creativethemeshq, is a dynamic WordPress plugin that enhances website functionality with various site-building tools. It has amassed over 7 million downloads and maintains an active installation base of 200,000 websites. Known for its robust performance and versatility, Blocksy Companion helps users seamlessly integrate advanced features into their WordPress sites.

Risks and Potential Impacts

The CSRF vulnerability in Blocksy Companion could allow attackers to manipulate site settings or content without the administrator’s knowledge. Such unauthorized actions could compromise site integrity, lead to data breaches, or disrupt service, posing significant risks to website owners and their users.

Remediation Steps

Upon identification of the vulnerability, the developers promptly released version 2.0.29 to address the security flaw. It is crucial for users of the Blocksy Companion plugin to update to this patched version immediately to secure their installations. Website administrators should also review their site’s activity logs for any signs of exploitation, which could help in mitigating any damage early.

Overview of Previous Vulnerabilities

Blocksy Companion has faced four previous vulnerabilities since March 4, 2022, each resolved by subsequent updates. This history not only reflects the plugin’s exposure to security risks but also demonstrates the developer's commitment to continual improvement and security reinforcement.


The rapid resolution of the CVE-2024-31932 vulnerability in the Blocksy Companion plugin highlights the vital importance of keeping digital tools up-to-date. For small business owners managing their WordPress sites, staying proactive with updates is crucial—not just for adding new features but for securing existing functionalities. In a landscape where digital threats are constantly evolving, keeping your software updated is a fundamental defense strategy, ensuring the security and reliability of your digital presence.

In the end, managing a WordPress site means staying vigilant against potential security threats. Regular updates, keen observation of security advisories, and prompt action are essential to safeguard your online assets in an ever-changing digital environment. This incident serves as a crucial reminder for all website owners about the importance of maintaining rigorous security practices in today's digital landscape.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Blocksy Companion Vulnerability – Cross-Site Request Forgery – CVE-2024-31932 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment