{"schema":"threatline.record/2","record":{"id":"CVE-2026-107645","aliases":[],"summary":"Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter","details":"The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.","categories":["Unclassified"],"product":"Blocksy Companion","vendor":"creativethemeshq","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107645","source_modified_at":"2026-10-11T16:55:20.206Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Blocksy Companion","vendor":"creativethemeshq","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.1.58","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00286,"percentile":0.2001,"score_date":"2026-10-23"},"published_at":"2026-10-10T03:26:44.942Z","modified_at":"2026-10-11T16:55:20.206Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107645","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T16:55:20.206Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107645","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7757f41d-c1f1-4df1-8048-b1c78a897548?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L241"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L181"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.58/framework/features/account-auth.php#L24"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3735192/blocksy-companion/tags/2.1.59/framework/features/account-auth.php?old=3723693&old_path=blocksy-companion%2Ftags%2F2.1.58%2Fframework%2Ffeatures%2Faccount-auth.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-11T16:38:17.189524Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T16:55:20.206Z","content_hash":"1b780ae494e537916ea01754b266f4cac939f4277bc0d125d832c92b11dce2bc"}}