Privilege Escalation Vulnerability in Blocksy Companion Plugin for WordPress

CVE-2026-107645

What is CVE-2026-107645?

The Blocksy Companion plugin for WordPress contains a security vulnerability that allows unauthenticated users to exploit a flaw in the implement_user_registration() AJAX handler. By disabling the Dokan vendor-registration nonce check, the plugin improperly trusts a user-supplied role in its registration process. This oversight can enable malicious actors to gain elevated privileges, essentially allowing them to create 'seller' accounts and bypass usual registration checks. As a result, attackers can access publisher capabilities, even on sites where vendor signups are disabled.

References