Key points
- The vulnerability affects Blocksy Companion plugin versions up to and including 2.1.58.
- Unauthenticated attackers can bypass security checks to create seller accounts.
- The flaw carries a CVSS score of 9.1, rated as critical by the NVD.
A critical security flaw in the Blocksy Companion WordPress plugin allows attackers to escalate privileges without logging in. The National Vulnerability Database (NVD) assigned the issue CVE-2026-107645 with a CVSS score of 9.1. This defect enables unauthorized users to seize vendor roles on affected sites, granting them publishing capabilities that normal customers do not possess.
By the numbers
- 9.1: The CVSS score assigned to CVE-2026-107645, indicating a critical severity level.
- 2.1.58: The highest version of the Blocksy Companion plugin affected by this privilege escalation flaw.
- 269: The CWE identifier for Improper Privilege Management, the weakness category for this bug.
What the figures mean
The Blocksy Companion plugin, developed by creativethemeshq, contains a flaw in its `implement_user_registration()` AJAX handler. According to the NVD record, this handler explicitly disables Dokan's vendor-registration nonce check. It does so by adding a filter that returns false for the nonce verification step. This action removes a standard security barrier designed to prevent unauthorized form submissions.
By disabling this check, the plugin trusts an attacker-supplied role value from the POST request. The code then invokes `wc_create_new_customer()` and `wc_set_customer_auth_cookie()` using this unverified data. This allows an unauthenticated attacker to elevate their privileges to a Dokan seller account. The attacker is automatically authenticated into this new account immediately after creation.
This escalation occurs even on sites where the Dokan vendor signup feature is explicitly turned off. The flaw bypasses administrative settings that restrict who can become a vendor. Once authenticated as a seller, the attacker gains publishing capabilities beyond those of a standard customer. This exposure allows for potential content manipulation or further lateral movement within the WordPress environment.
What should you do?
Managed service providers should audit all client sites running the Blocksy Companion plugin. Identify any installations using version 2.1.58 or earlier
