Blocksy Companion EUVD-2026-96038

Exploitation requires the Blocksy Companion plugin (≤2.1.58) with its implement_user_registration() AJAX handler reachable, AND the Dokan multivendor plugin active, because the payload abuses Dokan's vendor-registration nonce filter (dokan_register_nonce_check) and the 'seller' role passed to WooCommerce's wc_create_new_customer()/wc_set_customer_auth_cookie(). No authentication, no user interaction, and no valid nonce are needed - the handler explicitly returns false for the nonce check - and it works even when Dokan's vendor signup is turned off. The practical limiting factor is the stack dependency: sites running Blocksy Companion WITHOUT Dokan (and WooCommerce) lack the vendor role path, which narrows the exploitable population below what the 9.1 network/unauthenticated score implies.

Signals are largely consistent and point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality and integrity impact (base 9.1), and the description corroborates this: an unauthenticated AJAX handler deliberately disables the Dokan nonce check and trusts attacker-controlled $_POST['role']. There is no vendor attack-complexity trick to defeat, which supports AC:L. However, several real-world risk modifiers are MISSING from the input and should temper urgency: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. One important nuance the raw CVSS hides: successful exploitation of the 'seller/vendor' escalation path requires the Dokan multivendor plugin to be present alongside Blocksy Companion, so the full 9.1 impact is conditional on that stack rather than universal to all Blocksy Companion installs - verify the Dokan dependency against the Wordfence advisory before treating every Blocksy Companion site as critical.

An unauthenticated attacker sends a crafted POST request to the plugin's implement_user_registration() AJAX endpoint on a site running both Blocksy Companion (≤2.1.58) and Dokan, supplying role=seller. Because the handler forces the Dokan nonce check to return false and passes the attacker-chosen role into wc_create_new_customer()/wc_set_customer_auth_cookie(), the attacker is created as a vendor and auto-logged-in with publishing capabilities - even when Dokan vendor signup is disabled. No public exploit code is identified at time of analysis, but the flaw is trivially scriptable given the described mechanics.