https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 12:58:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-107645 <p><strong>Affected:</strong> creativethemeshq Blocksy Companion</p> <p>The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan&#39;s vendor-registration nonce check (via add_filter(&#39;dokan_register_nonce_check&#39;, &#39;__return_false&#39;)) and then trusting an attacker-supplied $_POST[&#39;role&#39;] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan &#39;seller&#39; (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.</p> <p><strong>Affected:</strong> creativethemeshq Blocksy Companion</p> <p>The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan&#39;s vendor-registration nonce check (via add_filter(&#39;dokan_register_nonce_check&#39;, &#39;__return_false&#39;)) and then trusting an attacker-supplied $_POST[&#39;role&#39;] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan &#39;seller&#39; (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.</p> https://vulnerability.circl.lu/vuln/cve-2026-107645