CVE-2026-107645

Name of the Vulnerable Software and Affected Versions Blocksy Companion versions prior to 2.1.59

Description A privilege escalation issue exists in the implement user registration() AJAX handler. The handler disables the Dokan vendor-registration nonce check (a security token used to prevent cross-site request forgery) and trusts the role variable provided via $ POST. This allows unauthenticated attackers to elevate their privileges to a Dokan seller account and be automatically authenticated, granting them publishing capabilities even on sites where vendor signup is disabled.

Recommendations Update the plugin to version 2.1.59 or later.