CVE-2026-107645: Blocksy Companion Plugin Lets Attackers Bypass Nonce Checks to Steal Seller Roles

The Blocksy Companion plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain elevated access. The National Vulnerability Database assigned CVE-2026-107645 a CVSS score of 9.1, classifying the issue as critical. The flaw exists in versions up to and including 2.1.58 of the plugin developed by creativethemeshq.

How does the privilege escalation work?

The vulnerability stems from how the `implement_user_registration()` AJAX handler processes user registration requests. According to the NVD record, this handler explicitly disables Dokan's vendor-registration nonce check by adding a filter that returns false. This bypass removes a standard security verification step that normally validates the legitimacy of the request origin.

By disabling this check, the handler then trusts an attacker-supplied `$_POST['role']` value. It passes this unverified role to `wc_create_new_customer()` and `wc_set_customer_auth_cookie()`. This sequence allows an attacker to define their own user role during the registration process without proper authorization or validation.

What are the impacts on affected sites?

An unauthenticated attacker can elevate their privileges to a Dokan 'seller' or vendor account. This occurs even on sites where the Dokan vendor signup feature is explicitly turned off by the administrator. The attacker is automatically authenticated into this newly created seller account immediately after registration.

This access grants publishing capabilities that exceed those of a normal customer. The attacker gains the ability to manage products and potentially interact with the store's backend in ways intended only for verified vendors. This effectively bypasses administrative controls designed to restrict who can become a seller on the platform.

Which versions are affected?

The vulnerability affects the Blocksy Companion plugin for WordPress in versions up to and including 2.1.58. Any installation running these older versions is susceptible to the described privilege escalation attack. The NVD record identifies creativethemeshq as the vendor responsible for the affected software component.

What steps should administrators take?

Security operations teams should audit their WordPress installations for the Blocksy Companion plugin. Administrators need to verify the current version number to determine if they are running a vulnerable build. If the plugin is present and below version 2.1.59, the site is exposed to this critical risk.

What mitigations are available?

The source material does not confirm the release of a patched version or a specific fix for CVE-2026-107645. Until the vendor provides an update, administrators should consider disabling the plugin if it is not essential. Monitoring for unauthorized user creation or new seller accounts is also advisable.

What to do and how to stay safe: Blocksy Companion

• Inventory all WordPress plugins and verify the version of Blocksy Companion against the vulnerable range.
• Monitor user registration logs for unexpected spikes or new accounts with seller or vendor roles.
• Review server logs for AJAX requests targeting the `implement_user_registration` handler from unauthenticated IPs.
• Restrict access to WordPress admin areas using IP whitelisting to reduce the attack surface for automated scans.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107645?

It is a critical privilege escalation vulnerability in the Blocksy Companion WordPress plugin that allows unauthenticated users to gain seller privileges.

Which versions of Blocksy Companion are vulnerable?

Versions up to and including 2.1.58 are affected by this vulnerability according to the NVD record.

Can attackers bypass disabled vendor signup?

Yes, the flaw allows attackers to create seller accounts even when the Dokan vendor signup feature is explicitly turned off by the administrator.