CVE-2026-107645

validated

GHSA-w5h9-m5j6-5394 ↗EUVD-2026-96038 ↗

check availablenot proven exploitable

cve.orgpublic pockev

creativethemeshq Blocksy Companion <= 2.1.58

CWE-269 Improper Privilege Management

ETK-2026-1134, permanent identifier

cvss9.1cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

+2h34mTTV

59mAI analysis

Check if you are vulnerable

timeline

0 = trigger signal

trigger signal (cve.org) +0hcheck available+2h34magent stopped

+1h

+2h

description

Blocksy Companion versions through 2.1.58 can allow an unauthenticated visitor to obtain and enter a Dokan seller account with elevated publishing permissions. The issue affects sites using the plugin’s relevant registration integration, including sites that have disabled Dokan vendor signup.

mitigation

Deactivate Blocksy Companion until the vendor supplies an updated release that corrects the registration handling. Do not rely on disabling Dokan vendor signup as the sole protective measure.

check

available

exploit

automation

deterministic

auth required

EPSS

0.29%19th percentile

agent run time

59m

cve.org record, t = 0

2026-10-10 03:26Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-10 03:26Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-107645

this entry in the feed

GET /api/v1/feed/CVE-2026-107645

{
  "etk_id": "ETK-2026-1134",
  "cve_id": "CVE-2026-107645",
  "display_id": "CVE-2026-107645",
  "ghsa_id": "GHSA-w5h9-m5j6-5394",
  "euvd_id": "EUVD-2026-96038",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated privilege escalation in Blocksy Companion",
  "summary": "Blocksy Companion versions through 2.1.58 can allow an unauthenticated visitor to obtain and enter a Dokan seller account with elevated publishing permissions. The issue affects sites using the plugin’s relevant registration integration, including sites that have disabled Dokan vendor signup.",
  "mitigation": "Deactivate Blocksy Companion until the vendor supplies an updated release that corrects the registration handling. Do not rely on disabling Dokan vendor signup as the sole protective measure.",
  "vendor": "creativethemeshq",
  "product": "Blocksy Companion",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.1.58"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Blocksy Companion",
      "purl": null
    }
  ],
  "cwes": [
    269
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0029,
  "epss_percentile": 0.1983,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 59.309581333333334,
  "t0_at": "2026-10-10T03:26:44.942000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T06:00:18.812744+00:00",
      "days": 0.1066420225,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T03:26:44.942000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-10T03:26:44.942000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T03:26:44.942000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107645"
    }
  }
}

published 2026-10-10 05:00Z
last change 2026-10-21 04:45Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.