Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Blocksy Companion plugin lets attackers become vendors

CVE-2026-107645 · published 26 days ago
Summary

The Blocksy Companion add‑on for WordPress (versions up to 2.1.58) can be tricked into creating a vendor account without proper checks. An attacker could sign up as a seller and be logged in automatically, gaining publishing rights that normal customers do not have. Update the plugin to a newer version or remove it if you do not need its features.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
creativethemeshq blocksy companion <= 2.1.58
Original advisory text
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published10 Oct 2026
Updated4 Nov 2026
First seen10 Oct 2026
Sources
CVE-2026-107645 · NVD
CVE-2026-107645 · MITRE
Track software like this
Free during beta