CVE-2026-107645: Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via addfilter('dokanregisternoncecheck', 'returnfalse')) and then trusting an attacker-supplied $POST['role'] value when invoking wccreatenewcustomer() and wcsetcustomerauthcookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed?
Sites using Blocksy Companion versions up to and including 2.1.58 are affected where the vulnerable registration AJAX handler is reachable. The issue can be exploited even if Dokan vendor signup has been explicitly disabled.
Does an attacker need an existing account or user interaction?
No. The vulnerability is unauthenticated and requires neither prior privileges nor user interaction; an attacker can supply the role parameter during registration.
What level of access can an attacker obtain?
An attacker can create and be automatically logged into a Dokan seller (vendor) account. This provides publishing capabilities beyond those available to a normal customer.