CVE-2026-107645

Summary

The Blocksy Companion plugin allows unauthenticated attackers to escalate privileges to Dokan seller accounts by manipulating the user registration process, bypassing security checks that should prevent unauthorized role assignment.

Exploitability

Exploitation is straightforward requiring no authentication or specific preconditions, as attackers can directly call the vulnerable AJAX handler with a crafted POST request containing a role parameter.

Blast radius

The vulnerability affects WordPress sites using both Blocksy Companion and Dokan plugins, potentially allowing attackers to gain publishing capabilities and seller privileges even on sites where vendor registration is disabled.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.1.59 or later to fix the privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.