CVSS 9.1: Blocksy Companion CVE-2026-107645 Enables Unauthenticated Vendor Account Creation via Nonce Bypass
A critical privilege escalation flaw in the Blocksy Companion WordPress plugin allows attackers to bypass security checks and create vendor accounts.
Key points
- CVE-2026-107645 affects Blocksy Companion versions up to and including 2.1.58.
- The flaw is rated CVSS 9.1 Critical due to unauthenticated privilege escalation.
- Attackers can bypass Dokan nonce checks to gain seller-level publishing rights.
The Blocksy Companion plugin for WordPress contains a critical security flaw that allows unauthenticated attackers to escalate their privileges. According to the National Vulnerability Database, this vulnerability, identified as CVE-2026-107645, affects plugin versions up to and including 2.1.58. The issue stems from how the plugin handles user registration requests.
The vulnerability exists within the `implement_user_registration()` AJAX handler. This function explicitly disables the Dokan vendor-registration nonce check by applying a filter that returns false. It then trusts an attacker-supplied role value from a POST request. This allows malicious actors to create accounts with elevated permissions without proper verification.
How the Privilege Escalation Works
The flaw enables attackers to elevate their status to a Dokan 'seller' or vendor account. This occurs even on sites where vendor signup is explicitly turned off. The plugin invokes `wc_create_new_customer()` and `wc_set_customer_auth_cookie()` using the untrusted role data. Consequently, the attacker is automatically authenticated into the new high-privilege account.
This automatic authentication grants the attacker publishing capabilities that exceed those of a normal customer. The weakness is classified under CWE-269, which relates to improper privilege management. The CVSS score of 9.1 reflects the severity of allowing remote, unauthenticated users to seize control functions.
Who Is Affected by CVE-2026-107645
Any WordPress site running the Blocksy Companion plugin from developer creativethemeshq is at risk if the version is 2.1.58 or earlier. Sites that integrate with the Dokan multi-vendor marketplace plugin are particularly vulnerable. The flaw bypasses existing security controls designed to prevent unauthorized vendor registrations.
Even if administrators have disabled public vendor signups, this specific code path allows the bypass. The attacker does not need existing credentials to exploit this issue. The resulting seller account provides immediate access to site features intended only for verified vendors.
Defender's checklist
Site administrators should immediately verify their installed version of the Blocksy Companion plugin. If the version is 2.1.58 or lower, the site is vulnerable to this privilege escalation. Users should review recent user registrations for any unexpected seller or vendor accounts. Monitoring logs for unusual AJAX requests can help detect exploitation attempts.
Background: Privilege escalation vulnerabilities
Privilege escalation vulnerabilities allow attackers to gain unauthorized access to higher-level system permissions. These flaws bypass security controls by exploiting misconfigurations or unpatched software. You must enforce least privilege and audit permissions regularly to prevent attackers from moving laterally and taking control of your critical assets.
Read the full guide: Privilege Escalation Vulnerabilities: How Attackers Steal Admin Control
What to do and how to stay safe: Blocksy Companion
- Check your WordPress plugin list for Blocksy Companion and verify the version number is higher than 2.1.58.
- Review your user database for any new seller or vendor accounts created without your explicit approval.
- Monitor server logs for suspicious AJAX requests targeting user registration endpoints.
- Once the vendor provides an update, apply it immediately to patch the privilege escalation flaw.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107645?
It is a critical privilege escalation vulnerability in the Blocksy Companion WordPress plugin that allows unauthenticated users to create seller accounts.
Which versions of Blocksy Companion are vulnerable?
Versions up to and including 2.1.58 are affected by this security flaw according to the NVD record.
Can attackers exploit this if vendor signup is disabled?
Yes, the flaw bypasses the nonce check and allows account creation even when vendor signup is explicitly turned off.
