CVE-2026-107645 in Blocksy Companion Plugin
Summary
by MITRE • 10/10/2026
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The Blocksy Companion plugin for WordPress contains a critical privilege escalation vulnerability in versions up to 2.1.58, stemming from improper access control mechanisms within its AJAX handler implementation. The core technical flaw lies in the implement_user_registration function, which explicitly disables security checks provided by the Dokan e-commerce extension. Specifically, the code applies a filter that returns false for dokan_register_nonce_check, effectively bypassing the nonce verification process designed to prevent cross-site request forgery and unauthorized registration attempts. This action removes a fundamental layer of defense intended to ensure that user registrations are initiated through legitimate, authenticated administrative interfaces rather than arbitrary external requests.
Following the disabling of this security check, the plugin proceeds to trust an attacker-supplied value from the $_POST['role'] parameter without adequate validation or authorization checks against the current session's permissions. This untrusted input is directly passed into WooCommerce functions wc_create_new_customer and wc_set_customer_auth_cookie. By controlling these inputs, an unauthenticated actor can force the system to create a new user account with elevated privileges, specifically assigning the role of Dokan seller or vendor. This mechanism allows for the creation of accounts that possess publishing capabilities far exceeding those of standard customer roles, such as managing products and processing orders.
The operational impact of this vulnerability is severe because it enables privilege escalation from an unauthenticated state to a privileged administrative-like role within the e-commerce ecosystem. Notably, this exploitation path remains effective even on WordPress sites where Dokan vendor registration has been explicitly disabled by administrators through standard configuration settings. The bypass of these restrictions demonstrates that the plugin's internal logic overrides site-level security policies, allowing attackers to establish persistent access and gain control over sensitive marketplace operations without prior authentication or administrative consent.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as well as CWE-352 regarding Cross-Site Request Forgery due to the reliance on manipulated POST data without proper nonce validation. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1078 Valid Accounts and potentially T1136 Create Account, illustrating how attackers can establish footholds by exploiting misconfigured application logic rather than traditional network exploits.
To mitigate this risk, administrators must immediately update the Blocksy Companion plugin to a version later than 2.1.58 where these access control flaws have been addressed. Until an official patch is applied or available from the vendor, it is advisable to restrict AJAX endpoint accessibility through web application firewall rules if possible and monitor for unusual user registration activity, particularly involving seller roles. Regular auditing of WordPress plugin code for improper use of filters that disable security checks can also help prevent similar privilege escalation vectors in other plugins relying on third-party integrations like Dokan or WooCommerce.