CVE-2026-8365

Name of the Vulnerable Software and Affected Versions Blocksy versions prior to 2.1.36

Description Insufficient input sanitization in the blocksy sanitize post meta options() function allows authenticated attackers with contributor-level access or higher to store serialized PHP object strings in post meta. The function only blocks values containing '<' or '>', failing to prevent the injection of serialized objects. When the V200 database migration occurs, the SearchReplacer::run recursively() function unconditionally deserializes all string values using @unserialize() without restricting allowed classes. This process can trigger the RaiiPattern:: destruct() function of an injected BlocksyRaiiPattern object, leading to remote code execution by executing arbitrary PHP callables via call user func(). This issue is accessible via the 'blocksy meta' REST API field.

Recommendations Update to version 2.1.36 or later. As a temporary mitigation, restrict access to the 'blocksy meta' REST API field for users with contributor-level permissions.