Blocksy Companion Auth Bypass Flaw Grants Unchecked Vendor Privileges on WordPress
Unauthenticated attackers can bypass security checks in Blocksy Companion to gain seller privileges and publish content on WordPress sites.
Key points
- CVE-2026-107645 is a critical privilege escalation flaw in Blocksy Companion versions up to 2.1.58.
- The bug allows unauthenticated users to bypass Dokan nonce checks and assume vendor roles.
- Attackers gain publishing capabilities and automatic authentication without valid credentials.
The Blocksy Companion plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to seize vendor roles. According to the National Vulnerability Database record for CVE-2026-107645, this flaw affects versions up to and including 2.1.58. The issue arises from how the plugin handles user registration requests. Attackers can exploit this weakness to elevate their privileges beyond standard customer limits. This creates significant operational risk for businesses using the plugin.
Root cause
The vulnerability stems from the `implement_user_registration()` AJAX handler within the Blocksy Companion codebase. According to the NVD description, this handler explicitly disables Dokan’s vendor-registration nonce check. It does so by applying the filter `add_filter('dokan_register_nonce_check', '__return_false')`.
This action removes a critical security layer designed to prevent unauthorized registration attempts. The plugin then proceeds to trust an attacker-supplied `$_POST['role']` value. This trust occurs when the code invokes `wc_create_new_customer()` and `wc_set_customer_auth_cookie()`. By accepting the role parameter without proper validation, the plugin fails to enforce intended access controls.
Attack path
An unauthenticated attacker can exploit this flaw to create a new account with elevated privileges. According to the source material, the attacker submits a request that includes a specific role value in the POST data. The plugin processes this request and creates the user account with the specified role. The attacker can specifically target the Dokan 'seller' or 'vendor' account type. This escalation works even on sites where the Dokan vendor signup feature is explicitly turned off. Once the account is created, the attacker is automatically authenticated into that session. This grants them publishing capabilities that exceed those of a normal customer.
Affected versions
The following versions of the Blocksy Companion plugin are affected by CVE-2026-107645:
- All versions up to and including 2.1.58
- The vulnerability is rated Critical with a CVSS score of 9.1
- The weakness is classified under CWE-269 (Improper Privilege Management)
- The vendor is identified as creativethemeshq
Mitigation
No patch or fix has been confirmed yet by the vendor. Organizations using the affected versions should take immediate defensive measures. Site administrators should audit user accounts for any unexpected vendor or seller roles. They should also review server logs for suspicious registration attempts from unauthenticated sources. If the plugin is not essential for the site’s operation, consider disabling or removing it. Until a secure update is available, restrict access to the WordPress admin area where possible. Monitor the vendor’s official channels for announcements regarding a security update.
What to do and how to stay safe: Blocksy Companion
- Audit your WordPress installation for any unexplained user accounts with vendor or seller privileges.
- Review server access logs for POST requests to the Blocksy Companion AJAX endpoints from unknown IPs.
- Restrict access to your WordPress admin interface to known IP addresses if feasible.
- Monitor the vendor’s website and security advisories for a confirmed patch or version update.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107645?
CVE-2026-107645 is a critical privilege escalation vulnerability in the Blocksy Companion WordPress plugin that allows unauthenticated attackers to gain vendor roles.
Which versions of Blocksy Companion are affected?
All versions of the Blocksy Companion plugin up to and including version 2.1.58 are affected by this vulnerability.
Can this exploit work if vendor signup is disabled?
Yes, according to the source material, attackers can elevate privileges to a vendor account even if the Dokan vendor signup is explicitly turned off.
