Critical Privilege Escalation Flaw Found in Blocksy Companion WordPress Plugin

Unauthenticated attackers can exploit CVE-2026-107645 to escalate privileges to seller accounts in vulnerable Blocksy Companion versions.

Threat Times Exposure DeskOctober 10, 20262 min read

Share LinkedIn Reddit

Illustration: A wooden desk holds a smartphone displaying a blank white screen with a single red upward arrow. — AI-generated illustration: Threat Times

Key points

The vulnerability allows unauthenticated users to bypass security checks and create privileged accounts.
Affected versions include all releases up to and including 2.1.58 of the Blocksy Companion plugin.
The flaw enables attackers to gain publishing capabilities even when vendor registration is disabled.

The National Vulnerability Database (NVD) has assigned CVE-2026-107645 to a critical security flaw in the Blocksy Companion plugin for WordPress. This vulnerability, rated 9.1 on the Common Vulnerability Scoring System (CVSS), allows unauthenticated attackers to escalate their privileges to a high-level seller account.

At a glance

CVE: CVE-2026-107645
Product: creativethemeshq Blocksy Companion
CVSS: 9.1 Critical
Weakness: improper privilege management
Exploited: No known exploitation

The issue stems from how the plugin handles user registration through an AJAX handler named `implement_user_registration()`. According to the NVD record, this handler explicitly disables the nonce check for vendor registration in the Dokan plugin by adding a filter that returns false. By bypassing this security mechanism, the plugin then trusts a role value supplied by an attacker in a POST request. This allows the attacker to invoke functions that create a new customer and set an authentication cookie, effectively logging them into the newly created privileged account.

Technical Context and Impact

The vulnerability is categorized under CWE-269, which relates to improper privilege management. The exploit allows an attacker to elevate their status to a Dokan 'seller' or vendor account. This is particularly dangerous because it grants the attacker publishing capabilities that exceed those of a standard customer.

Furthermore, the flaw functions even on sites where the Dokan vendor signup feature has been explicitly turned off by the administrator. The attacker is automatically authenticated into the compromised seller account upon creation, providing immediate access to the elevated privileges without needing to guess or steal existing credentials.

Affected Versions and Scope

The vulnerability affects the Blocksy Companion plugin developed by creativethemeshq. All versions up to and including 2.1.58 are considered vulnerable. Sites running these versions are exposed to the privilege escalation risk described in the NVD record.

The Blocksy Companion plugin is designed to enhance the functionality of the Blocksy theme, often integrating with e-commerce plugins like Dokan to manage multi-vendor marketplaces. The integration with Dokan’s registration process is where the security failure occurs, as the companion plugin overrides the necessary security checks.

What should you do?

Site administrators should immediately audit their WordPress installations to determine if they are using the Blocksy Companion plugin. If the plugin is present, they should check the version number against the vulnerable range (up to 2.1.58).

Users should monitor their site logs for unusual registration activity, particularly new accounts with seller or vendor roles created without corresponding legitimate sign-up processes. Since the flaw allows unauthenticated access, any sudden appearance of new high-privilege accounts is a strong indicator of exploitation.

Administrators should restrict access to the admin dashboard where possible and ensure that other security layers, such as web application firewalls, are active to filter out malicious POST requests. While no fix has been confirmed yet in the source material, users should prepare to update once the vendor provides a patched version.

What to do and how to stay safe: Blocksy Companion

Check your WordPress plugin list for Blocksy Companion and verify if the version is 2.1.58 or older.
Review user accounts for any new seller or vendor roles created recently without legitimate authorization.
Monitor server logs for suspicious AJAX requests targeting user registration endpoints.
Prepare to apply updates immediately once the vendor releases a patch for CVE-2026-107645.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.