Key points
- The vulnerability affects Blocksy Companion versions up to and including 2.1.58.
- Attackers can bypass Dokan nonce checks to create accounts with seller privileges.
- No patch or fix has been confirmed yet for this critical issue.
Security researchers have identified a critical privilege escalation vulnerability in the Blocksy Companion plugin for WordPress. According to the National Vulnerability Database (NVD), the flaw carries a CVSS score of 9.1, indicating a severe risk to affected websites. The issue allows unauthenticated attackers to elevate their access levels significantly without needing valid login credentials.
In plain English
The Blocksy Companion plugin contains a coding error that disables standard security checks for vendor registration. Specifically, the plugin’s code explicitly turns off the nonce verification process that Dokan normally uses to protect its registration system. By disabling this safeguard, the plugin allows external users to submit role assignments that the system accepts as valid.
The background
This vulnerability exists in versions of Blocksy Companion up to and including 2.1.58. The flaw was reported to the NVD under CVE-2026-107645. The issue stems from how the plugin handles AJAX requests for user registration. Instead of verifying the authenticity of the request, the code trusts user-supplied data to determine the new account’s role.
What changes now
Unauthenticated attackers can exploit this flaw to create new accounts with the ‘seller’ or ‘vendor’ role in Dokan. This occurs even on sites where vendor sign-up is explicitly turned off by the administrator. Once the account is created, the attacker is automatically authenticated into the system. This grants them publishing capabilities and other permissions that exceed those of a standard customer.
What to do and how to stay safe: Blocksy Companion
- Audit your WordPress installations to identify if Blocksy Companion version 2.1.58 or earlier is installed.
- Monitor server logs for unusual registration patterns or attempts to create accounts with elevated roles.
- Consider disabling the Blocksy Companion plugin temporarily if you cannot verify its security status.
- Review user accounts for any unauthorized seller or vendor roles that were created recently.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Blocksy Companion are affected?
All versions of the Blocksy Companion plugin up to and including version 2.1.58 are vulnerable to this privilege escalation flaw.
Can attackers use this flaw if vendor registration is disabled?
Yes, the vulnerability allows attackers to bypass the setting that disables vendor sign-ups, granting them seller access regardless of configuration.
Is there a fix available yet?
No fix has been confirmed yet. Users should monitor for official updates from the vendor or apply compensating controls in the meantime.
