Unauthenticated attackers can seize vendor roles via Blocksy Companion flaw

Organisations using the Blocksy Companion plugin for WordPress face immediate risk from a critical privilege escalation vulnerability. According to the National Vulnerability Database, this flaw allows unauthenticated attackers to gain elevated access. The issue impacts versions up to and including 2.1.58. Security researchers have assigned the identifier CVE-2026-107645 to this specific weakness.

How does the privilege escalation function technically?

The vulnerability stems from how the plugin handles user registration requests. The `implement_user_registration()` AJAX handler explicitly disables the nonce check required by the Dokan multi-vendor marketplace plugin. It achieves this by applying a filter that returns false for the `dokan_register_nonce_check` action. This removal of a fundamental security control leaves the registration process open to manipulation by external actors.

Furthermore, the handler trusts a role value supplied directly by the attacker via the `$_POST['role']` parameter. It passes this unverified data into the `wc_create_new_customer()` function. This sequence allows an attacker to define their own permissions during the account creation process, bypassing standard validation routines that would normally restrict role assignment to trusted administrators or approved vendors.

What access do attackers gain through this exploit?

Successful exploitation grants unauthenticated users a Dokan 'seller' or vendor account. This access is significant because it provides publishing capabilities that exceed those of a standard customer. Attackers can create this account even if the site administrator has explicitly turned off vendor signup features. The system fails to enforce the disabled setting due to the bypassed nonce check and trusted role input.

Additionally, the exploit triggers the `wc_set_customer_auth_cookie()` function immediately after account creation. This action auto-authenticates the attacker into the newly created seller account. The attacker gains an active session without needing to guess or crack a password. This immediate access facilitates rapid exploitation, allowing the attacker to publish content or manipulate store settings before detection.

Which sites are affected by this vulnerability?

The flaw affects any WordPress installation running the Blocksy Companion plugin by creativethemeshq. Specifically, versions up to and including 2.1.58 are vulnerable. Sites that do not use the Dokan plugin may still be at risk if the code path is triggered, though the primary impact involves Dokan vendor accounts. The vulnerability is classified under CWE-269, which relates to improper privilege management.

The severity is rated as critical with a CVSS score of 9.1. This high score reflects the ease of exploitation and the significant impact on system integrity. Unauthenticated attackers require no prior access to trigger the flaw. The combination of bypassing authentication checks and gaining elevated privileges makes this a high-priority issue for site administrators.

What is the current status of a fix?

No patch or update has been confirmed yet by the vendor. Administrators should monitor official channels from creativethemeshq for a release. Until a fix is available, sites running affected versions remain exposed. The lack of a confirmed fix means that mitigation relies on configuration changes or temporary workarounds that may impact site functionality.

What steps should administrators take now?

Administrators should audit their WordPress installations for the Blocksy Companion plugin. Check the version number against the affected list. If running version 2.1.58 or earlier, prepare for an urgent update once released. Monitor server logs for unusual account creation activity, particularly new vendor accounts. Restrict access to registration endpoints if possible without breaking site functionality.

What to do and how to stay safe: Blocksy Companion

• Audit your WordPress plugins to identify if Blocksy Companion version 2.1.58 or earlier is installed.
• Monitor authentication logs for sudden spikes in new vendor or seller account creations.
• Review server access logs for requests targeting the `implement_user_registration` AJAX handler.
• Prepare to update the plugin immediately once the vendor releases a confirmed patch.

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-107645?

The National Vulnerability Database rates the severity as critical with a CVSS score of 9.1.

Which versions of Blocksy Companion are affected?

Versions up to and including 2.1.58 are vulnerable to this privilege escalation flaw.

Can attackers exploit this if vendor signup is disabled?

Yes, the flaw allows attackers to bypass the disabled vendor signup setting and create seller accounts.