IT SBIT Services
Schneeberger
DEEN
CVE tracker

Blocksy Companion: Unauthenticated privilege escalation to Dokan seller role

CVE-2026-107645Critical 9.1

← All vulnerabilities

Summary

Blocksy Companion up to and including 2.1.58 lets unauthenticated attackers register accounts with a supplied role parameter. On sites that also run the Dokan marketplace plugin, an attacker can obtain a Dokan seller (vendor) account and is logged in automatically. The flaw bypasses the Dokan vendor registration setting, so it also works where vendor signup is disabled. The vulnerability is rated critical (CVSS 9.1).

Affected

  • Blocksy Companion 2.1.58 and all earlier versions
  • Only sites where Dokan is also active
  • Blocksy theme versions before 2.1.59 may also be affected (vendor release timing)

Fixed in

  • Blocksy Companion 2.1.59 (released 2026-10-08), changelog: "Account modal – respect Dokan vendor registration setting."

Workaround

  • No vendor workaround documented.
  • If patching is not possible, restrict the affected AJAX endpoint with web application firewall rules (secondary source VulDB).
  • Review the user list for unexpected accounts with the Dokan seller role.

Exploitation

  • No evidence of exploitation in the wild found.
  • No public proof of concept found.
  • EPSS about 0.003 (low).
  • Not listed in CISA KEV according to one aggregator; check the KEV catalog directly.
  • Low barrier (no login, no user interaction), so automated exploitation is plausible once the flaw is widely understood (assessment).

Our recommendation

  • Update Blocksy Companion to 2.1.59 or later, and check the Blocksy theme version.
  • Inventory WordPress sites that run Blocksy Companion and Dokan.
  • Review recently created accounts with the Dokan seller role and remove unknown ones.
  • Check logs for new seller registrations from unknown sources.
  • Monitor for new user registrations, especially with the seller role.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:02.

Original description (NVD)

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed